Windows Registry forensics is an important branch of computer and network forensics. Windows Registry is often considered as the heart of Windows Operating Systems because it contains all of the configuration setting of specific users, groups, hardware, software, and networks. Therefore, Windows Registry can be viewed as a gold mine of forensic evidences which could be used in courts. This pape...

Digital's eXcursion for Windows display server is an application for Microsoft Windows. The eXcursion for Windows product is based on the X Window System and allows X client applications to display output, receive input, and exchange data in the Microsoft Windows environment. The eXcursion software visually integrates the X and Microsoft Windows environments-applications from both environments ...

A method to extract information of network connection status information from physical memory on Windows Vista operating system is proposed. Using this method, a forensic examiner can extract accurately the information of current TCP/IP network connection information, including IDs of processes which established connections, establishing time, local address, local port, remote address, remote p...