====== Digital Forensics Windows ======

===== Definition =====
Digital Forensics Windows is an index for real forensic concepts in this part of the Anti-Forensics.com wiki.
Use it like a field shelf: start with the concept, read the limits, then follow the related entries when the evidence starts arguing with itself.

===== Articles =====
  * [[wiki:digital_forensics:windows:windows_prefetch|Windows Prefetch]]
  * [[wiki:digital_forensics:windows:amcache|Amcache]]
  * [[wiki:digital_forensics:windows:shimcache|Shimcache]]
  * [[wiki:digital_forensics:windows:srum|SRUM]]
  * [[wiki:digital_forensics:windows:windows_registry|Windows Registry]]
  * [[wiki:digital_forensics:windows:registry_hives|Registry Hives]]
  * [[wiki:digital_forensics:windows:ntuser_dat|NTUSER.DAT]]
  * [[wiki:digital_forensics:windows:system_hive|SYSTEM Hive]]
  * [[wiki:digital_forensics:windows:software_hive|SOFTWARE Hive]]
  * [[wiki:digital_forensics:windows:sam_hive|SAM Hive]]
  * [[wiki:digital_forensics:windows:security_hive|SECURITY Hive]]
  * [[wiki:digital_forensics:windows:userassist|UserAssist]]
  * [[wiki:digital_forensics:windows:shellbags|ShellBags]]
  * [[wiki:digital_forensics:windows:jump_lists|Jump Lists]]
  * [[wiki:digital_forensics:windows:lnk_files|LNK Files]]
  * [[wiki:digital_forensics:windows:recentdocs|RecentDocs]]
  * [[wiki:digital_forensics:windows:typedpaths|TypedPaths]]
  * [[wiki:digital_forensics:windows:runmru|RunMRU]]
  * [[wiki:digital_forensics:windows:opensavemru|OpenSaveMRU]]
  * [[wiki:digital_forensics:windows:wordwheelquery|WordWheelQuery]]
  * [[wiki:digital_forensics:windows:muicache|MUICache]]
  * [[wiki:digital_forensics:windows:bam_and_dam|BAM and DAM]]
  * [[wiki:digital_forensics:windows:windows_event_logs|Windows Event Logs]]
  * [[wiki:digital_forensics:windows:security_event_log|Security Event Log]]
  * [[wiki:digital_forensics:windows:system_event_log|System Event Log]]
  * [[wiki:digital_forensics:windows:application_event_log|Application Event Log]]
  * [[wiki:digital_forensics:windows:powershell_logs|PowerShell Logs]]
  * [[wiki:digital_forensics:windows:powershell_script_block_logging|PowerShell Script Block Logging]]
  * [[wiki:digital_forensics:windows:sysmon_events|Sysmon Events]]
  * [[wiki:digital_forensics:windows:scheduled_tasks|Scheduled Tasks]]
  * [[wiki:digital_forensics:windows:windows_services|Windows Services]]
  * [[wiki:digital_forensics:windows:service_control_manager_events|Service Control Manager Events]]
  * [[wiki:digital_forensics:windows:run_keys|Run Keys]]
  * [[wiki:digital_forensics:windows:startup_folders|Startup Folders]]
  * [[wiki:digital_forensics:windows:wmi_persistence|WMI Persistence]]
  * [[wiki:digital_forensics:windows:bits_jobs|BITS Jobs]]
  * [[wiki:digital_forensics:windows:usb_device_history|USB Device History]]
  * [[wiki:digital_forensics:windows:mounteddevices|MountedDevices]]
  * [[wiki:digital_forensics:windows:setupapi_logs|SetupAPI Logs]]
  * [[wiki:digital_forensics:windows:rdp_artifacts|RDP Artifacts]]
  * [[wiki:digital_forensics:windows:terminal_services_logs|Terminal Services Logs]]
  * [[wiki:digital_forensics:windows:windows_firewall_logs|Windows Firewall Logs]]
  * [[wiki:digital_forensics:windows:windows_defender_logs|Windows Defender Logs]]
  * [[wiki:digital_forensics:windows:windows_search_database|Windows Search Database]]
  * [[wiki:digital_forensics:windows:thumbcache|Thumbcache]]
  * [[wiki:digital_forensics:windows:iconcache|IconCache]]
  * [[wiki:digital_forensics:windows:recycle_bin_on_windows|Recycle Bin on Windows]]
  * [[wiki:digital_forensics:windows:volume_shadow_copy_on_windows|Volume Shadow Copy on Windows]]
  * [[wiki:digital_forensics:windows:ntfs_change_journal|NTFS Change Journal]]
  * [[wiki:digital_forensics:windows:prefetch_run_counts|Prefetch Run Counts]]
  * [[wiki:digital_forensics:windows:program_compatibility_assistant|Program Compatibility Assistant]]
  * [[wiki:digital_forensics:windows:appcompatcache|AppCompatCache]]
  * [[wiki:digital_forensics:windows:windows_timeline_activity|Windows Timeline Activity]]
  * [[wiki:digital_forensics:windows:cloud_clipboard_artifacts|Cloud Clipboard Artifacts]]
  * [[wiki:digital_forensics:windows:onedrive_artifacts|OneDrive Artifacts]]
  * [[wiki:digital_forensics:windows:teams_artifacts_on_windows|Teams Artifacts on Windows]]
  * [[wiki:digital_forensics:windows:outlook_ost_files|Outlook OST Files]]
  * [[wiki:digital_forensics:windows:event_log_clearing|Event Log Clearing]]
  * [[wiki:digital_forensics:windows:windows_time_service_logs|Windows Time Service Logs]]
  * [[wiki:digital_forensics:windows:windows_update_logs|Windows Update Logs]]

===== Core Navigation =====
  * [[wiki:start|Main Index]]
  * [[wiki:tools:start|Forensic Tools]]
  * [[wiki:resources:start|Project Resources]]
  * [[wiki:support|Support Anti-Forensics.com]]

===== Use Notes =====
This article is for defensive education and technical reference. It should not be treated as legal, forensic, investigative, compliance, or operational advice without qualified professional judgment.