Internship
Student login
← Digital Forensics learning path
Digital Forensics · Module 6 of 10

Windows forensics artefacts

Find traces of activity on Windows systems.

📖 Key ideas

  1. Windows Registry stores settings and usage traces.
  2. Event logs record logins, errors and system events.
  3. Prefetch and shortcuts (LNK) show program use.
  4. Browser history, downloads and cache reveal web activity.
  5. Recycle Bin and USB device history give clues.
💡 Real-life example: Windows artefacts are footprints left in sand: they show where a user walked.
RegistryWindows configuration database
Event logRecord of system events
PrefetchFiles showing program execution
LNK fileShortcut file with metadata