Forensically significant information in Windows OS

This article considers the components of the Windows operating system that may contain important information for the work of a digital forensics expert and provides examples of software that simplifies the search for information required by an expert. Since technology-related crimes are reaching a new level, specialists in this field must promptly identify information that can help solve a case. The article shows methods for studying the contents of operating system components using built-in system tools. It also presents utilities that help automate the process of searching for information on a computer and shows their interfaces. Verifying information with a single program does not guarantee the reliability and completeness of the data obtained. Therefore, an expert in the field of computer forensics should be able to use several programs and utilities.

References

[1] Computer and Technical Forensics. URL: http://www.sudexpert.ru/possib/comp.php (accessed 09.04.2024).

[2] Microsoft. Windows Registry Information for Advanced Users. URL: https://learn.microsoft.com/ru-ru/troubleshoot/windows-server/performance/windows-registry-advanced-users (accessed 09.04.2024).

[3] Karlova A.V. Determining the Circumstances of Working with USB Devices in the Windows Operating System. Polytechnic Youth Journal, 2019, No. 4(33). (In Russ.). URL: https://ptsj.bmstu.ru/articles/465/465.pdf (accessed 09.04.2024).

[4] Windows 7 Event Viewer Overview. URL: https://acerfans.ru/faq/1317-obzor-prosmotra-sobytij-operacionnoj-sistemy (accessed April 9, 2024).

[5] Windows Main Directories and Their Structure. URL: https://windowso.ru/articles/osnovnye-katalogi-windows-i-ih-struktura (accessed 09.04.2024).

[6] Microsoft. View or Delete Browsing History in Microsoft Edge. URL: https://support.microsoft.com/ru-ru/microsoft-edge/view-or-delete-sogotago-zhurnala-browser-v-microsoft-edge-00cf7943-a9e1-975a-a33d-ac10ce454ca4 (accessed 09.04.2024).

[7] Utilities for searching information on a computer. URL: https://fcenter.ru/online/hardarticles/utilities/7332-Utility_dlya_poiska_informacii_na_komp_jutere (accessed 09.04.2024).

[8] 15 Best Computer (Digital) Forensics Tools and Software in 2024. URL: https://www.guru99.com/ru/computer-forensics-tools.html (accessed 09.04.2024).

[9] 15 Best Free Computer Forensics Tools. URL: https://habr.com/ru/companies/tomhunter/articles/660773/ (accessed 09.04.2024).