I'd like to back up important Windows files for forensic purposes. I am aware of the Event Logs and Anti Virus logs, are there any other logs or files that have personal use information, connections or any other important information that could be backed up aside from that? If so, where is it located?


Forensic Purposes is far reaching. There are a huge and scattered number of resources that can be important in a forensic analysis. What's more, the relationship of this data to file contents and time stamps are huge.

It sounds like you're interested in collecting specific logs. Forensic purposes really implies a full system copy or "Image".

A middle ground would be a Triage capture of target subsets. Often this includes recently run executable file names and sometimes snapshots of running network connections or even memory dumps, depending upon your objectives.

There is no simple list short of "everything". You'll need to refine your objective.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.