An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1

Diana Hintea; Robert Bird; Michael Green

doi:10.1504/IJESDF.2017.10008013

An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1

Diana Hintea, Robert Bird, Michael Green

Research output: Contribution to journal › Article › peer-review

4 Citations (Scopus)

Abstract

With the release of Microsoft's latest operating system, Windows 10, forensic investigators must examine it in order to determine the changes implemented from Windows 8.1 and the addition of new artefacts. This study is an analysis of Windows 10 and its new features in order to distinguish these artefacts. The tools used include: VMware Fusion, FTK Imager, Process Monitor, Process Explorer, ESEDatabase View and Registry Explorer. The paper also determines if artefacts have changed in Windows 10 in comparison to the previous version of Windows, Windows 8.1. When comparing the two it was found that many of the pre-existing artefacts found within Windows 8.1 are still present in Windows 10. Slight differences are noted in the way prefetch files are compressed and also the thumbnail databases. Significant artefacts related to the new features in Windows 10 are also reported.

Original language	English
Pages (from-to)	326-345
Number of pages	20
Journal	International Journal of Electronic Security and Digital Forensics
Volume	9
Issue number	4
Early online date	25 Sept 2017
DOIs	https://doi.org/10.1504/IJESDF.2017.10008013
Publication status	Published - Nov 2017

Access to Document

10.1504/IJESDF.2017.10008013

Cite this

An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1. / Hintea, Diana; Bird, Robert; Green, Michael.

In: International Journal of Electronic Security and Digital Forensics, Vol. 9, No. 4, 11.2017, p. 326-345.

Research output: Contribution to journal › Article › peer-review

@article{34ddd1ea402f4578894ecfc771c3ebc0,

title = "An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1",

abstract = "With the release of Microsoft's latest operating system, Windows 10, forensic investigators must examine it in order to determine the changes implemented from Windows 8.1 and the addition of new artefacts. This study is an analysis of Windows 10 and its new features in order to distinguish these artefacts. The tools used include: VMware Fusion, FTK Imager, Process Monitor, Process Explorer, ESEDatabase View and Registry Explorer. The paper also determines if artefacts have changed in Windows 10 in comparison to the previous version of Windows, Windows 8.1. When comparing the two it was found that many of the pre-existing artefacts found within Windows 8.1 are still present in Windows 10. Slight differences are noted in the way prefetch files are compressed and also the thumbnail databases. Significant artefacts related to the new features in Windows 10 are also reported. ",

author = "Diana Hintea and Robert Bird and Michael Green",

year = "2017",

month = nov,

doi = "10.1504/IJESDF.2017.10008013",

language = "English",

volume = "9",

pages = "326--345",

journal = "International Journal of Electronic Security and Digital Forensics",

issn = "1751-911X",

publisher = "Inderscience",

number = "4",

}

TY - JOUR

T1 - An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1

AU - Hintea, Diana

AU - Bird, Robert

AU - Green, Michael

PY - 2017/11

Y1 - 2017/11

N2 - With the release of Microsoft's latest operating system, Windows 10, forensic investigators must examine it in order to determine the changes implemented from Windows 8.1 and the addition of new artefacts. This study is an analysis of Windows 10 and its new features in order to distinguish these artefacts. The tools used include: VMware Fusion, FTK Imager, Process Monitor, Process Explorer, ESEDatabase View and Registry Explorer. The paper also determines if artefacts have changed in Windows 10 in comparison to the previous version of Windows, Windows 8.1. When comparing the two it was found that many of the pre-existing artefacts found within Windows 8.1 are still present in Windows 10. Slight differences are noted in the way prefetch files are compressed and also the thumbnail databases. Significant artefacts related to the new features in Windows 10 are also reported.

AB - With the release of Microsoft's latest operating system, Windows 10, forensic investigators must examine it in order to determine the changes implemented from Windows 8.1 and the addition of new artefacts. This study is an analysis of Windows 10 and its new features in order to distinguish these artefacts. The tools used include: VMware Fusion, FTK Imager, Process Monitor, Process Explorer, ESEDatabase View and Registry Explorer. The paper also determines if artefacts have changed in Windows 10 in comparison to the previous version of Windows, Windows 8.1. When comparing the two it was found that many of the pre-existing artefacts found within Windows 8.1 are still present in Windows 10. Slight differences are noted in the way prefetch files are compressed and also the thumbnail databases. Significant artefacts related to the new features in Windows 10 are also reported.

U2 - 10.1504/IJESDF.2017.10008013

DO - 10.1504/IJESDF.2017.10008013

M3 - Article

SN - 1751-911X

VL - 9

SP - 326

EP - 345

JO - International Journal of Electronic Security and Digital Forensics

JF - International Journal of Electronic Security and Digital Forensics

IS - 4

ER -

An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1

Abstract

Access to Document

Fingerprint

Cite this