Digital Evidence and Computer Crime, Second Edition

10.10 Summary

Microsoft is continually developing new systems that bring new sources of digital evidence. Although the next generation of Microsoft file systems will be significantly different from its predecessors, many of the existing systems will continue to be sources of digital evidence. Therefore, an understanding of existing file systems and artifacts is a necessary component of a digital evidence examiner's training. Additionally, there will be similarities between new systems and their predecessors and certain features will remain the same. An understanding of existing systems will make it easier for digital evidence examiners to become familiar with new systems.