Windows 10® Workshop 8 Hours

Get the knowledge and skills necessary to analyze the latest Windows® 10 operating system artifacts, user data and explore the many updates this new Operating System has introduced.

Windows® 10 Overview

A general overview of Windows 10 functionality, focusing on the new artifacts of interest to the digital forensic examiner.


System Artifacts

A deep dive into the core system artifact updates on a standard Windows 10 environment.  Students will be exposed to changes and updates to the following items:

  • File System
  • Disk Layout
  • Recycle Bin
  • Prefetch Compression


User Artifacts

Windows 10 brings many new items of interest to the forensic examiner; this session focuses on new items of interest within the user profile where day-to-day activity on the host system has occurred.

Items covered include

  • Edge Browser structure and artifacts
  • Cortana’s interaction with the system and user activity including data files located in the package folder structure.

Also covered at notification updates and decompiling of data structures, examination of the Timeline function and artifacts, Windows Mail and the ‘Comms’ folder, Registry updates, and OneDrive sync considerations.



To get the most out of this class, you should:

  • Have minimal experience of forensic examinations.

Download the Syllabus

Download a printable copy of the course description and key learning points.

Hosting Courses

If you are interested in hosting this, or any of our courses at your facility, contact us.

Ready to get started?