Page 1

WINDOWS FORENSICS · A GUIDE FOR UK LAWYERS What Evidence Can Be Recovered from a Windows Computer? Deleted Files, USB History, Logins, Browsing, Execution Traces and the Timeline They Build COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 35 and CrimPR Part 19. Its e Discovery arm, e-discovery.uk, integrates device-level findings into disclosure-scale COURT-EXPERIENCED EXPERT WITNESSES

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the machine remembers 03 Deleted files and where they hide 04 USB devices and external media history 05 Logins, accounts and who was at the keyboard 06 Files opened, folders browsed: the recency artefacts 07 Programs run: the execution artefacts 08 Browsing, search in g and the online record 09 Event logs and the system's own diary 10 Building the timeline: from artefacts to narrative 11 Worked examples 12 Common mistakes and technical limitations 13 Questions to ask · Suggested wording 14 Checklist and red flags · When to involve a digital forensic expert 15 Frequently asked questions 16 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: WINDOWSRECORDSFARMORETHANUSERSCREATE

§ 02 · FIRST PRINCIPLES The problem in plain English: the machine remembers

§ 03 · WHATDELETIONLEAVES Deleted files and where they hide