TYPES OF DIGITAL FORENSIC ARTIFACTS IN WINDOWS COMPUTERS

Abstract

Recently, the issue of solving various tasks in conditions of initial data shortage becomes more relevant. It is related to various problems, but some of them have arisen and continue to arise as a result of the constant Ukraine’s economy cripple during the war with Russian Federation. Currently both countries have entered the “war of attrition” phase. Therefore, there is an objective need to investigate this process and develop strategies, methods and algorithms for adaptation to new conditions, when the initial data base becomes insufficient for tasks solving. Many examples can be given when it is vital to solve tasks under the lack of resources. For example, the distribution of 10 body armor vests among 100 soldiers in a company; treatment the wounded under the medicine’s shortage conditions; solving information tasks when there is a lack of the necessary data. We will investigate information tasks related to computer forensics. When a hacked computer is examined, it is necessary to detect the fact of unauthorized access to the software, as well as analyze in detail its causes and consequences. These tasks have already been largely solved and published. But the researched publications consider cases when the computer is available and there is enough time for analysis. It is also considered that the researcher qualification is at a correspondingly high level. But what if there is not enough time, qualifications, and the volume of received initial data? What and how should we do? The article is devoted to the above-mentioned situation. It starts in and does series of articles, arranged in the direction of “Solving the computer forensics issues in the conditions of incomplete initial data”.