Chapter 9. Windows Files

In the previous chapter, we discussed the Windows log files and discussed how important they are for analysis. However, Windows logs aren't the only important artifact in Windows. In this chapter, we will discuss more important Windows files that are usually created in the normal Windows operations but may have evidential importance from our prospective of the case under investigation.