Windows forensic files

Question

I'd like to back up important Windows files for forensic purposes. I am aware of the Event Logs and Anti Virus logs, are there any other logs or files that have personal use information, connections or any other important information that could be backed up aside from that? If so, where is it located?

Answer 1

Forensic Purposes is far reaching. There are a huge and scattered number of resources that can be important in a forensic analysis. What's more, the relationship of this data to file contents and time stamps are huge.

It sounds like you're interested in collecting specific logs. Forensic purposes really implies a full system copy or "Image".

A middle ground would be a Triage capture of target subsets. Often this includes recently run executable file names and sometimes snapshots of running network connections or even memory dumps, depending upon your objectives.

There is no simple list short of "everything". You'll need to refine your objective.