Legacy Operating System Artifacts
Thus far, the artifacts mentioned have been for the most recent Windows operating systems, namely, Windows 2000/XP/2003 and Windows Vista and beyond. Windows 9x systems, while rapidly disappearing from the scene, are still encountered. Table 9-6 lists the locations of several artifacts on Windows 9x systems. Other than being located in a different place or named differently, they are functionally the same.
Table 9-6: Windows 9x artifacts and their paths
| Description | Filename and path |
| Swap file. | C:\WIN386.SWP |
| Recent folder whose contents appear in the Windows 9x Start > Documents menu. | C:\Recent |
| Desktop items. | C:\Desktop |
| My Documents folder. | C:\My Documents |
| Internet cache and index.dat. | C:\Windows\Temporary Internet ... |
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
