has moved to this site, For information, please join the Google Group forensicswiki-reborn


From Forensics Wiki
Jump to navigation Jump to search

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Windows is a widely-spread operating system from Microsoft.

There are 2 main branches of Windows:

  • the DOS-branch: i.e. Windows 95, 98, ME
  • the NT-branch: i.e. Windows NT 4, XP, Vista


  • Basic and Dynamic Disks, see: [1]

Introduced in Windows NT

Introduced in Windows 2000

Introduced in Windows XP


  • Windows Firewall

Introduced in Windows Server 2003

Introduced in Windows Vista

Introduced in Windows Server 2008

Introduced in Windows 7

Introduced in Windows 8

Introduced in Windows Server 2012

Introduced in Windows 10


Partition layout

Default partition layout, first partition starts:

  • at sector 63 in Windows 2000, XP, 2003
  • at sector 2048 in Windows Vista, 2008, 7


Hosts information


Recycle Bin

The Recycle Bin contains "Recycled" files. Moving files and directories to the Recycle Bin is also referred to as soft deletion, since the files are not removed from the file system.


The Recycler format is used by Windows 2000, XP.

Per user Recycle Bin folder in the form:


Which contains:

  • INFO2 file; "Recycled" files metadata


The $Recycle.Bin is used as of Windows Vista.

Per user Recycle Bin folder in the form:


Which contains:

  • $I files; "Recycled" file metadata
  • $R files; the original data


The Windows Registry is a database of keys and values that provides a wealth of information to forensic investigators.

Thumbs.db Files

Thumbs.db files can be found on many Windows systems. They contain thumbnails of images or documents and can be of great value for the investigator.

See also: Vista thumbcache.

Browser Cache

Browser History

The Web Browser History files can contain significant information. The default web browser that comes with Windows is Microsoft Internet Explorer but other common browsers on Windows are Apple Safari, Google Chrome, Mozilla Firefox and Opera.


See Windows Desktop Search

Setup API Logs

Windows Vista introduced several new Setup API Log files.

Also see [2].

Scheduled Tasks

In Windows the Scheduled Tasks can be found in:


This directory contains .job files which are in the Windows Job File Format.

In later versions of Windows (at least Windows 7) XML-based equivalents can be found in the following locations:



After (at least) Windows 7 recovers from sleep/hibernation there often is a system time change event (event id 1) in the event logs.


Windows stores a users Security identifiers (SIDs) under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

The %SID%\ProfileImagePath value should also contain the username.

Crash and minidumps


Windows Error Reporting (WER)

As of Vista, for User Access Control (UAC) elevated applications WER reports can be found in:


As of Vista, for non-UAC elevated applications (LUA) WER reports can be found in:


Corresponding registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting

Advanced Format (4KB Sector) Hard Drives

Windows XP does not natively handle drives that use the new standard of 4KB sectors. For information on this, see Advanced Format.


The actual value of %SystemRoot% is stored in the following registry value:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Value: SystemRoot

See Also

External Links

Client/Server Runtime Subsystem (CSRSS)

Recycle Bin


Tracking removable media

Under the hood

Windows File Protection (WFP)


Side-by-side (WinSxS)

Crash dumps


Reliability Monitoring


User Account Control (UAC)

Windows Event Logs

Windows Scripting Host



Windows Error Reporting (WER)

Windows Event Viewer

Windows Firewall

Windows 32-bit on Windows 64-bit (WoW64)

Windows XP

Windows Scheduler

Windows Vault