[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-292247-105":59,"doc-detail-292247-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","windows-artifacts-exercise-lesson-plan-materials","Windows Artifacts Exercise - Lesson plan materials","","Windows Artifacts Exercise is a hands-on forensic learning module introducing how Windows operating systems and tools generate forensic artifacts that can be analyzed. The slides are excerpted from Cal Lee’s “Advanced Digital Forensics” class and support practice using tools in the BitCurator Environment. It includes learning objectives, reference sample data, and guidance on locating and understanding files related to Windows environments. Topics cover operating system market share, visibility of computer files, and key Windows registry areas and five main registry files with their purposes.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":20,"@type":76,"position":81},"https://docshare.wps.com/document/exam/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/windows-artifacts-exercise-lesson-plan-materials/292247/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/windows-artifacts-exercise-lesson-plan-materials/292247.png","ImageObject",300,407,{"name":92,"@type":93},"Cipher","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-04","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":29},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What is the purpose of the Windows Artifacts Exercise?","Question",{"text":112,"@type":113},"It introduces students to forensic artifacts produced by Windows operating systems and tools, and teaches them how to analyze those artifacts.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What tools and environment are students expected to practice with?",{"text":117,"@type":113},"Students practice using tools in the BitCurator Environment as part of the exercise objectives.",{"name":119,"@type":110,"acceptedAnswer":120},"Which five main Windows registry files are covered, and what does each represent?",{"text":121,"@type":113},"The module covers NTUSER.DAT, SAM, SECURITY, SOFTWARE, and SYSTEM, each describing different categories such as user account info, security policies, installed applications, and system settings.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},292247,1789649390,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":19,"category_name":20,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":29,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":129,"read_time":144},687208528416,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Windows Artifacts Exercise  \nBitCuratorEdu Last Updated: January 18, 2022  \nAbout This Exercise  \nAuthor  \nCal Lee  \nDescription  \nThis hands-on exercise introduces students to forensic artifacts produced by Windows operating systems and tools to analyze them. These slides are excerpted from Cal Lee’s SAA “Advanced Digital Forensics” class. The sample data referenced in these slides is available here:  \n[https://github.com/BitCurator/bcc-dfa-sample-data/](https://github.com/BitCurator/bcc-dfa-sample-data/)  \nLearning object type  \nLesson plan/materials  \nLearning objectives  \nThis learning object might be used in a lesson to satisfy the following learning objectives:  \n● Practice using tools in the BitCurator Environment.  \nWindows Artifacts  \nDesktop Operating System Market Share  \n[https://www.netmarketshare.com/operating-system-market-share.aspx](https://www.netmarketshare.com/operating-system-market-share.aspx)  \nLet’s make sure you can see all of the files on your  \ncomputer.  \n6  \nWindows Registry  \n■ Information about:◻ Applications installed  \n◻ Application settings ◻ Hardware installed ◻ Hardware settings  \n◻ User interface and system preferences ◻ User accounts  \n◻ Locations of files and recent activities, e.g. Most Recently Used (MRU)  \n◻ Lots of online activities, e.g. user names and passwords, browsing and search query history  \nFive Main Registry Files  \n\n| File | Description |\n| --- | --- |\n| NTUSER.DAT | One for each user account, includes information such as Most Recently Used (MRU) file lists, desktop settings, default application behaviors |\n| SAM (Security Accounts Manager) | User account information (including passwords) and security settings |\n| SECURITY | User and group security policies, e.g. which accounts can load device drivers, get remote access to the machine |\n| SOFTWARE | Information about all install programs, including settings and directory paths |\n| SYSTEM | Windows systems settings, such as drive letter mappings, storage volume information, system boot profile, last known good configuration, system name, Windows setup information, hardware profile information |","cbCain8oWbT1cqR8","https://ap.wps.com/l/cbCain8oWbT1cqR8","pdf",2008896,43,"English","# About This Exercise\n## Learning object type\n## Learning objectives\n# Windows Artifacts\n## Desktop Operating System Market Share\n## Let’s make sure you can see all of the files on your computer\n## Windows Registry\n### Information about\n## Five Main Registry Files\n## NTUSER.DAT\n## SAM\n## SECURITY\n## SOFTWARE\n## SYSTEM","[{\"question\":\"What is the purpose of the Windows Artifacts Exercise?\",\"answer\":\"It introduces students to forensic artifacts produced by Windows operating systems and tools, and teaches them how to analyze those artifacts.\"},{\"question\":\"What tools and environment are students expected to practice with?\",\"answer\":\"Students practice using tools in the BitCurator Environment as part of the exercise objectives.\"},{\"question\":\"Which five main Windows registry files are covered, and what does each represent?\",\"answer\":\"The module covers NTUSER.DAT, SAM, SECURITY, SOFTWARE, and SYSTEM, each describing different categories such as user account info, security policies, installed applications, and system settings.\"}]","Windows Artifacts Exercise - Lesson plan materials | PDF",108]