Windows is the operating system most investigators meet first, and it records an enormous amount about what users and programs have done. These traces are called artifacts, and learning where they are stored and what they mean is the core skill of Windows forensics.
You'll start with the Windows Registry, its hives, and the keys that reveal user accounts, recently used files, and connected USB devices. Then you'll look at event logs for logons and system activity, Prefetch files as evidence that a program was run, and artifacts like ShellBags and UserAssist that show how a user moved around the system.
Next up is Linux & macOS Forensics, where you'll see how the same questions are answered on other operating systems.
A TryHackMe walkthrough covering registry hive locations, investigation tools, and artifacts such as UserAssist, MRUs, ShellBags, and external USB devices.
A conference session on the Windows 10 artifacts that can be used in post-incident analysis or a computer investigation.
How to use Eric Zimmerman's EvtxECmd tool to parse Windows Event Log (EVTX) files into a format that's easy to analyse.
How Prefetch files record program execution, and how to read them to find out what ran on a Windows system and when.