> For the complete documentation index, see [llms.txt](https://dika-maulidal.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics.md).

# Windows Forensics

- [NTFS](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/ntfs.md)
- [Prefetch](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/prefetch.md)
- [LNK Files](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/lnk-files.md)
- [Jump Lists](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/jump-lists.md)
- [Thumbcache](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/thumbcache.md)
- [Event Log](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/event-log.md): Cheat Sheet Windows Event Log
- [Registry](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry.md)
- [NTUSER.DAT](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry/ntuser.dat.md)
- [UsrClass.dat](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry/usrclass.dat.md)
- [System](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry/system.md)
- [SAM (Security Account Manager)](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry/sam-security-account-manager.md)
- [Software](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry/software.md)
- [AmCache.hve](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/registry/amcache.hve.md)
- [SRUM](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/srum.md)
- [Windows Timeline](https://dika-maulidal.gitbook.io/home/digital-forensics/windows-forensics/windows-timeline.md)