Windows Third Party Apps Forensics Poster

The world runs on Microsoft Windows largely because of the diversity of available third-party applications. Artifacts left behind by these applications are as diverse as the applications themselves, spanning the file system. Here you will find some of the most important artifacts available from popular Windows applications including browsers, productivity and communication applications, and cloud storage. This poster is a detailed exploration of artifacts from 46 third-party applications commonly found on devices running the Windows operating system.

Please note that applications change over time and older or newer applications will inevitably store data in different locations. While a comprehensive view is impractical, these locations make excellent places to begin an investigation