The final report is here!
The Windows 10 Final Report is finally ready to be released. This project was a continuation from the Windows 10 project done earlier last year. In the Fall 2015 semester, the LCDI team did further exploration into tasks that remained unfinished at the conclusion of the previous part of the project. The team used a Microsoft Surface 3 tablet running the factory released Windows 10 operating system to compare the artifacts from the previous analysis of the technical release of Windows 10.
Purpose and Scope of Windows 10 Final Report
The purpose of this report is to serve as a digital forensic resource to the default locations of artifacts located within the Windows 10 environment. The results of this research will be useful for forensics investigators encountering Windows 10 computers and devices. Since Windows 10 is available to users currently using Windows 7, 8, and 8.1 free of charge, many devices that investigators will come in contact with in the foreseeable future post-release will be running Windows 10.
Research Questions:
- What artifact locations are different between Windows 10 Technical Build and Windows 10 Official versions?
- What types of artifacts are stored by Windows 10 Applications, and where are these artifacts found?
- What difficulties may law enforcement encounter when forensically analyzing Windows tablet devices and information?
- What new features and applications in Windows 10 have artifacts that will be of help to law enforcement?
To read the Windows 10 Final Report, follow this link. Questions or comments? Feel free to email us at lcdi@champlain.edu or give us a call at (802) 865-5744. Don’t forget to follow us on Facebook and Twitter!