Windows Forensic Artifacts

Windows computers leave behind many digital traces during normal use. These traces can help forensic investigators understand which applications existed on a system and identify evidence related to user activity. Among the most important Windows forensic artifacts are Amcache, Shimcache, and UserAssist. Each artifact records different information. Therefore, investigators must ...