Introduction to Windows
摘要
It is certainly possible to perform Windows forensics without a deep understanding of the operating system. That is, however, a serious mistake. The various automated forensics tools, many of which you will see in this textbook, can provide you evidence, but they cannot interpret the evidence for you. Furthermore, the automated tools cannot always catch everything. To be a truly competent Windows forensic examiner, you must have an understanding of the operating system itself. The goal of this chapter is to provide you a working knowledge of the Windows operating system and a strong foundation for learning more. To be able to truly perform forensics on any system, you need a deep understanding of that system.