Temp Folder

The Temp folder is a subfolder of the Local Settings folder. With Windows Vista (and beyond), this folder appears in the path Users\%UserName%\AppData\Local\Temp. As the name implies, the purpose of the Temp folder is to temporarily store files. There seems to be no end to the types of files you can find here. This is a good place to look after running a file-signature analysis because often programs create working copies of open documents in this area, changing their extensions. Some programs delete them when done, and others simply leave behind their garbage. I once found three files that were more than 2 GB each in this area. They apparently were created during a major system malfunction and were rich with evidence.

This area is ...

Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.