Where Is the Evidence? Devices, File Systems and Windows Artifacts

What you'll be able to do

By the end of this lesson you will be able to plan where to look for evidence on a device, instead of searching blindly.

• Use the four questions that decide where evidence lives: media type, file system, operating system and scope.
• Name the common file systems for each kind of device.
• Describe the Windows locations and registry records that examiners check first, including the history of USB devices.

"Where Is the Evidence?" "It Depends."

Dr. Al-Doori starts this section with a game of question and answer. Where is the evidence? It depends. Depends on what? On what you are looking for. It is not a joke: there is no single place where all digital evidence lives. To know where to look, an examiner needs four pieces of background:

1. The type of digital media.
2. The file system on that media.
3. The operating system that used it.
4. The scope you are allowed to search.

The Media

The book surveys the devices you are likely to meet:

• Laptops and desktops. Usually the largest capacity, and often a record of what the suspect did before, during and after a crime.
• USB sticks. Portable, ever larger, and used to carry files between computers, which makes them a prime place for evidence of copying or theft.
• CDs and DVDs. Less common since USB sticks took over, but still used to store things.
• Smartphones. Once just communication devices, now equivalent to a computer, with the added evidence of photos, call logs, location data and messages.
• Game consoles. Easily overlooked, but many have large internal drives that can store evidence too.

The File System

Each device's file system decides how its data is organized, and therefore what can be recovered and what extra information exists. The book's example: the NTFS Master File Table holds more information about each file than a FAT file system does, which can matter to a case.

The Operating System

Operating systems place data in predictable locations by default. If you know where an operating system puts user documents, settings and logs, finding them is much faster. The book lists Windows (and DOS), macOS, Linux, Android and Solaris; today you would add iOS for iPhones and iPads.

The Scope

Most important of all is the scope of the warrant or authority. The book gives examples of how narrow it can be: some warrants allow only certain folders to be searched, some allow only non-deleted data, and some only files changed during a certain period. You must read the authority and know your scope before you search any of the media, because evidence gathered beyond it may be ruled inadmissible.

Windows: The First Places to Look

Because most desktop and laptop computers run Windows, the book gives it special attention. Good starting points include:

• The user's own folders, such as the Desktop and Documents, where users keep their files.
• The browser cache and history. The book names Temporary Internet Files, the cache of the old Internet Explorer. Modern browsers keep their history and cache in each user's profile folders.
• Deleted files and the Recycle Bin, a good resource when someone is trying to hide information.

The Registry and USB History

The Windows Registry is a large database of settings, and the book calls it a huge source of user information. One famous example: most USB storage devices report an identifying serial number, and Windows records which USB devices have been connected. When a device reports none, Windows builds its own ID from where the device was plugged in, and that ID cannot identify the physical stick. Only an advanced user, or anti-forensic software, is likely to clear this. The book gives two locations:

First time a USB storage device connected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Last time a USB device connected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses

The book adds a warning: be careful when working with the registry, because changes can damage a system beyond repair. In forensic work you never edit the registry on the evidence. You examine the registry files (called hives) from the forensic image, with forensic tools.

Real-World Example

Imagine (a fictional scenario) a company investigating whether an employee copied client lists before resigning. The authority covers the employee's work laptop and the period from 1 to 30 June.

The examiner works through the four questions. Media: a laptop with an internal SSD. File system: NTFS. Operating system: Windows 11. Scope: June only. In the registry hives from the image, the USB device records show a storage device with a particular serial number first connected on 12 June. Other Windows records give the time it was last connected and which user account was signed in. The employee's Recent items show files from a "Clients" folder being opened at the same time. The examiner reports that a specific USB device was connected while those files were being accessed, and the company can ask the employee to return that device with that serial number.

From the Book to 2026

What the book teaches. Over 90% of the world's computers run Windows; Macs use HFS; Windows user data sits in folders such as My Documents and Temporary Internet Files; the registry keys above record USB history.

Why it made sense. Windows has long dominated desktops, and these locations and keys have been standard forensic starting points for years.

What has changed. The share figure is out of date: StatCounter's September 2026 data puts Windows at about 76% of desktop and laptop operating systems worldwide, and across all devices, including phones, Android is the most used. Macs now use APFS rather than HFS. "My Documents" is now simply Documents, inside each user's folder, and Internet Explorer has been replaced by modern browsers with their own history files. For USB history, examiners now correlate several Windows records rather than relying on one key: the USBSTOR entries, Windows' device-installation log (SetupAPI), and records showing which user account mounted the device. One technical detail is worth knowing: in a SYSTEM hive taken from an image, CurrentControlSet does not exist, because it only exists on a running system. You look under ControlSet001 (or whichever control set the hive's Select key marks as current).

What to do now. Keep the book's four questions and its Windows starting points, but expect a mix of Windows, macOS, phones and cloud accounts. Use an up-to-date artifact reference, such as the SANS Windows Forensic Analysis poster, and confirm every important finding from more than one artifact.

Watch: USB Forensics, Part 1

This short episode from SANS Digital Forensics and Incident Response, the forensics arm of a leading security training organization, opens a seven-part series on USB device forensics.

Questions to keep in mind as you watch:

• Which Windows registry hives and records are used to reconstruct USB history, and how do they connect to the book's USBSTOR key?
• Why might an examiner need more than one artifact to establish first and last connection times?
• How would you stay within scope when the USB history shows devices outside the period you are allowed to examine?

The video complements what you just read. The lesson is complete without it. For an optional broader introduction, see the further-study link on this lesson.

What Would You Do?

A warrant authorizes a search of a suspect's laptop "for documents created or modified between 1 and 31 January". The registry shows an unknown USB device connected on 3 February, and the Recycle Bin holds a file deleted in December. Which of these can you examine? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Where evidence lives depends on four things: media type, file system, operating system and scope.
• File systems differ in what they record: NTFS's Master File Table holds more about each file than FAT.
• Windows starting points: user folders, browser history, deleted files and the Recycle Bin, and the registry.
• USB history comes from several registry and log records together. Examine hives from the image, never edit the live registry.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.5
• StatCounter Global Stats — Desktop Operating System Market Share Worldwide (September 2026)
• Apple Support — File system formats available in Disk Utility on Mac
• Microsoft Learn — SetupAPI text logs
• Microsoft Learn — Master File Table (Local File Systems)
• SANS — Windows Forensic Analysis poster