Difference between pages "List of Jump List IDs" and "Windows 8"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (Application IDs)
 
(External Links)
 
Line 1: Line 1:
=== Application IDs ===
+
Initially Windows 8 had a workstation and server edition. The server edition became Windows Server 2012.
  
<table border="1">
+
== New Features ==
<th>AppID</th><th> Application Description</th><th>Date Added</th><th>Source</th>
+
The following new features were introduced in Windows 8:
<tr><td>89b0d939f117f75c</td><td>Adobe Acrobat 9 Pro Extended (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
* [[Windows File History | File History]]
<tr><td>26717493b25aa6e1</td><td>Adobe Dreamweaver CS5 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
* [[Windows Storage Spaces | Storage Spaces]]
<tr><td>e2a593822e01aed3</td><td>Adobe Flash CS5 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
* [[Search Charm History]]
<tr><td>c765823d986857ba</td><td>Adobe Illustrator CS5 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>84f066768a22cc4f</td><td>Adobe Photoshop CS5 (64-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
== File System ==
<tr><td>44a398496acc926d</td><td>Adobe Premiere Pro CS5 (64-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
The file system used by Windows 8 is primarily [[NTFS]].
<tr><td>d5c3931caad5f793</td><td>Adobe Soundbooth CS5 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>c7a4093872176c74</td><td>Paint Shop Pro Pinned and Recent.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
The [[Resilient File System (ReFS)]] was initially available in the Windows 8 server edition but became part of Windows 2012 server edition.
<tr><td>b91050d8b077a4e8</td><td>Media Center.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>f5ac5390b9115fdb</td><td>PowerPoint 2007.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
== Jump Lists ==
<tr><td>23646679aaccfae0</td><td>Adobe Reader 9.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
[[Jump Lists]] are Task Bar artifacts that were first introduced on Windows 7 and are also available on Windows 8.
<tr><td>28c8b86deab549a1</td><td>Internet Explorer 8 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>918e0ecb43d17e23</td><td>Notepad (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
== [[Prefetch]] ==
<tr><td>9b9cdc69c1c24e2b</td><td>Notepad (64-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
The prefetch hash function is similar to [[Windows 2008]].
<tr><td>74d7f43c1561fc1e</td><td>Windows Media Player 12 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>b0459de4674aab56</td><td>Windows Virtual PC - vmwindow.exe (32- and 64-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
The [[Windows Prefetch File Format]] was changed on Windows 8.1 to version 26. (note this could be Windows 8 as well but has not been confirmed)
<tr><td>6728dd69a3088f97</td><td>Windows Command Processor - cmd.exe (64-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>954ea5f70258b502</td><td>Windows Script Host - wscript.exe (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
== Registry ==
<tr><td>9f5c7755804b850a</td><td>Windows Script Host - wscript.exe (64-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
The [[Windows_Registry|Windows Registry]] remains a core component of the Windows operating system.
<tr><td>9839aec31243a928</td><td>Microsoft Excel 2010 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
 
<tr><td>9c7cc110ff56d1bd</td><td>Microsoft Powerpoint 2010 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
== Application Experience and Compatibility ==
<tr><td>a7bd71699cd38d1c</td><td>Microsoft Word 2010 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
On Windows 8 Amcache.hve replaces RecentFileCache.bcf and uses the [[Windows NT Registry File (REGF)]] format. A common location for Amcache.hve is:
<tr><td>5c450709f7ae4396</td><td>Firefox 3.6.13 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
<pre>
<tr><td>43578521d78096c6</td><td>Media Player Classic Home Cinema 1.3 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
C:\Windows\AppCompat\Programs\Amcache.hve
<tr><td>e70d383b15687e37</td><td>Notepad++ 5.6.8 (32-bit)</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
</pre>
<tr><td>1b4dd67f29cb1962</td><td>Explorer (task bar folder icon)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
 
<tr><td>1bc392b8e104a00e</td><td>Remote Desktop</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
== See Also ==
<tr><td>23646679aaccfae0</td><td>Adobe Reader 9 x64</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [[Windows]]
<tr><td>271e609288e1210a</td><td>Access 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [[Windows Vista]]
<tr><td>28c8b86deab549a1</td><td>Internet Explorer x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [[Windows 7]]
<tr><td>290532160612e071</td><td>WinRar x64</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
 
<tr><td>2b53c4ddf69195fc</td><td>Zune x64</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
== External Links ==
<tr><td>3094cdb43bf5e9c2</td><td>OneNote 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://en.wikipedia.org/wiki/Features_new_to_Windows_8 Features new to Windows 8], Wikipedia
<tr><td>5da8f997fd5f9428</td><td>Internet Explorer x64</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://computerforensics.champlain.edu/blog/windows-8-forensics Windows 8 Forensics - part 1]
<tr><td>74d7f43c1561fc1e</td><td>Windows Media Player</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://computerforensics.champlain.edu/blog/windows-8-forensics-part-2 Windows 8 Forensics - part 2]
<tr><td>9839aec31243a928</td><td>Excel 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://computerforensics.champlain.edu/blog/windows-8-forensics-part-3 Windows 8 Forensics - part 3]
<tr><td>9b9cdc69c1c24e2b</td><td>Notepad x64</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://propellerheadforensics.files.wordpress.com/2012/05/thomson_windows-8-forensic-guide2.pdf Windows 8 Forensic Guide], by [[Amanda Thomson|Amanda C. F. Thomson]], 2012
<tr><td>9c7cc110ff56d1bd</td><td>PowerPoint 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://forensicfocus.com/Forums/viewtopic/t=9604/ Forensic Focus: Windows 8 Forensics - A First Look], [http://www.youtube.com/watch?v=uhCooEz9FQs&feature=youtu.be Presentation], [http://www.forensicfocus.com/downloads/windows-8-forensics-josh-brunty.pdf Slides], by [[Josh Brunty]], August 2012
<tr><td>a7bd71699cd38d1c</td><td>Word 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://dfstream.blogspot.ch/2013/03/windows-8-tracking-opened-photos.html Windows 8: Tracking Opened Photos], by [[Jason Hale]], March 8, 2013
<tr><td>b8c29862d9f95832</td><td>InfoPath 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://dfstream.blogspot.com/2013/09/windows-8-and-81-search-charm-history.html Windows 8 and 8.1: Search Charm History], by [[Jason Hale]], September 9, 2013
<tr><td>b91050d8b077a4e8</td><td>Windows Media Center  x64</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://www.swiftforensics.com/2013/12/amcachehve-in-windows-8-goldmine-for.html Amcache.hve in Windows 8 - Goldmine for malware hunters], by Yogesh Khatri, December 4, 2013
<tr><td>be71009ff8bb02a2</td><td>Outlook x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
* [http://www.swiftforensics.com/2013/12/amcachehve-part-2.html Amcache.hve - Part 2], by Yogesh Khatri, December 16, 2013
<tr><td>d64d36b238c843a3</td><td>InfoPath 2010 x86</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
 
<tr><td>e36bfc8972e5ab1d</td><td>XPS Viewer</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4907 Win4n6 List Serv ]</td></tr>
+
[[Category:Operating systems]]
<tr><td>17d3eb086439f0d7</td><td>TrueCrypt 7.0a</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>adecfb853d77462a</td><td>MSWord 2007</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>c71ef2c372d322d7</td><td>PGP Desktop 10</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>cdf30b95c55fd785</td><td>MSExcel 2007</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>f5ac5390b9115fdb</td><td>MSPowerPoint 2007</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>12dc1ea8e34b5a6</td><td> MSPaint 6.1</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>431a5b43435cc60b</td><td>Python (.pyc)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>469e4a7982cea4d4</td><td>? (.job)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>500b8c1d5302fc9c</td><td>(.pyw)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>50620fe75ee0093</td><td> VMWare Player 3.1.4</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>65009083bfa6a094</td><td>(app launched via XPMode)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>7e4dca80246863e3</td><td>Control Panel (?)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>83b03b46dcd30a0e</td><td>iTunes 10</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>b0459de4674aab56</td><td>(.vmcx)</td><td>8/22/2011</td><td>[http://tech.groups.yahoo.com/group/win4n6/message/4910 Win4n6 List Serv ]</td></tr>
+
<tr><td>1b4dd67f29cb1962</td><td>Windows Explorer Pinned and Recent.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
<tr><td>d7528034b5bd6f28</td><td>Windows Live Mail Pinned and Recent.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
<tr><td>adecfb853d77462a</td><td>Word 2007 Pinned and Recent.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
<tr><td>a8c43ef36da523b1</td><td>Word 2003 Pinned and Recent.</td><td>8/22/2011</td><td>[http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/92b90228-2f08-4558-9c4d-6e66e103a5cf Microsoft Windows 7 Forum ]</td></tr>
+
</table>
+

Latest revision as of 15:13, 16 December 2013

Initially Windows 8 had a workstation and server edition. The server edition became Windows Server 2012.

New Features

The following new features were introduced in Windows 8:

File System

The file system used by Windows 8 is primarily NTFS.

The Resilient File System (ReFS) was initially available in the Windows 8 server edition but became part of Windows 2012 server edition.

Jump Lists

Jump Lists are Task Bar artifacts that were first introduced on Windows 7 and are also available on Windows 8.

Prefetch

The prefetch hash function is similar to Windows 2008.

The Windows Prefetch File Format was changed on Windows 8.1 to version 26. (note this could be Windows 8 as well but has not been confirmed)

Registry

The Windows Registry remains a core component of the Windows operating system.

Application Experience and Compatibility

On Windows 8 Amcache.hve replaces RecentFileCache.bcf and uses the Windows NT Registry File (REGF) format. A common location for Amcache.hve is:

C:\Windows\AppCompat\Programs\Amcache.hve

See Also

External Links