ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Windows 7

From ForensicsWiki
Revision as of 17:23, 12 September 2013 by Dcowen (Talk | contribs)

Jump to: navigation, search

File Structure

File systems are covered separately.


Per MS KB2727880, when Windows 7 is installed on a system with an SSD drive, automatic defragmentation and SuperFetch/prefetching are disabled.

Further, this TechNet post states: Since ReadyBoost will not provide a performance gain when the primary disk is an SSD, Windows 7 disables ReadyBoost when reading from an SSD drive.

Jump Lists

Jump Lists are Task Bar artifacts first introduced on Windows 7 (and also available on Windows 8).


The Windows_Registry remains a central component of the Windows 7 operating system.

Known keys of forensic interest

SAM Registry



Security Registry