Fundamentals of Digital Forensics
5. Identification and analysis of information in Operating Systems
According to “https://gs.statcounter.com/os-market-share/desktop/worldwide”, the Microsoft Windows operating system has a market share of about 75 per cent, followed by Apple OS X with 14.5 per cent. A forensic analyst will find considerably more devices with Micrososft Operating systems than any other. This justifies the greater attention given to the analysis of this operating system.
SANS has carried out excellent research and education work in the area of digital forensics, one of the factors of interest being the regular publication of the so-called Poster, at: https://www.sans.org/posters/, with the result of that research. These Posters are also important sources of information regarding the location of artefacts of forensic interest, as MS Windows operating systems store numerous artefacts in the daily actions of its users.