Title: An investigation into the forensic implications of the Windows 10 operating system: recoverable artefacts and significant changes from Windows 8.1

Authors: Diana Hintea; Robert Bird; Michael Green

Addresses: Faculty of Engineering, Environment and Computing, Coventry University Gulson Rd, Coventry, CV1 2JH West Midlands, UK ' Faculty of Engineering, Environment and Computing, Coventry University Gulson Rd, Coventry, CV1 2JH West Midlands, UK ' Faculty of Engineering, Environment and Computing, Coventry University Gulson Rd, Coventry, CV1 2JH West Midlands, UK

Abstract: With the release of Microsoft's latest operating system, Windows 10, forensic investigators must examine it in order to determine the changes implemented from Windows 8.1 and the addition of new artefacts. This study is an analysis of Windows 10 and its new features in order to distinguish these artefacts. The tools used include: VMware Fusion, FTK Imager, Process Monitor, Process Explorer, ESEDatabase View and Registry Explorer. The paper also determines if artefacts have changed in Windows 10 in comparison to the previous version of Windows, Windows 8.1. When comparing the two it was found that many of the pre-existing artefacts found within Windows 8.1 are still present in Windows 10. Slight differences are noted in the way prefetch files are compressed and also the thumbnail databases. Significant artefacts related to the new features in Windows 10 are also reported.

Keywords: Windows 10; forensic analysis; digital forensic acquisition.

DOI: 10.1504/IJESDF.2017.087394

International Journal of Electronic Security and Digital Forensics, 2017 Vol.9 No.4, pp.326 - 345

Received: 06 Jul 2016
Accepted: 16 Jan 2017
Published online: 14 Oct 2017 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article