MICROSOFT WINDOWS IS A VERY COMMONLY used operating system. Therefore, it is important that you be very familiar with conducting forensics on Windows machines. In this chapter, you learn how to perform a forensic examination of a Windows computer. That includes examining the Registry, the index.dat file, the swap file, and more.