Forensic Analysis of Microsoft Windows Prefetch Artefacts Assessment

The Research Report

This is the third assessment, and it’s worth 25% of the total course grade. It’ll require you to select one (1) Microsoft Windows artefact from the list provided above and then conduct your own research about how the selected artefact can be exploited for information during a digital forensic investigation. As this assessment is post your first investigation, you’re expected to conduct some of your own independent technical research to demonstrate your understanding of the artefact. This should complement any existing research you find regarding the artefact. Don’t forget to detail the internals of the artefact.

NB: Both artefacts within the list have already been thoroughly researched and documented within the open-source community. Once complete, you are to compile your research into a research report of approximately five (5) to six (6) pages in length.

Aims

On completion of this assessment, you should be able to demonstrate the following Learning Outcomes:

• LO2: Demonstrate how to utilise contemporary open-source tools, techniques, and

procedures to conduct forensic analysis

• LO3: Demonstrate your ability to derive and exploit the forensic value of atomic operating system artefacts using first principles

Furthermore, through the successful completion of this assessment you’ll progress the

development of the following graduate attributes:

• The ability to engage in independent and reflective learning
• The skills to locate, evaluate, and use relevant information
• The skills to effectively communicate

Constraints

The deliverable for this assessment must conform to a defined research report format. This report must include the following compulsory sections:

• Abstract (~300 words in length)
• Introduction (~400 words in length)
• Technical Analysis (~2000 words in length)
• Limitations (~300 words in length)

Assessment Criteria

Assessment of the research report will be based on the assessment criteria guide as below:

Quality of the Abstract: 15%

• Did the abstract clearly and concisely summarise your research?
• Was the overall purpose of the research articulated?
• Were the major findings of your analysis included?
• Was there a brief summary of your interpretations and conclusions?

Quality of the Introduction: 15%

• Did the introduction clearly and concisely summarise the artefact’s background information, including its actual purpose within the Microsoft Windows operating system?
• Was the scope, context, and significance of the research established?

Quality of the Technical Analysis: 35%

• Did the technical analysis clearly and concisely describe the internal data structures and/or technical implementations of the selected artefact?
• Was the forensic importance of the artefact’s internal structures and technical

implementations clearly and concisely articulated?

• Was the technical analysis complete, within the predefined scope?
• Was the technical analysis accurate, absent of fabricated analysis outcomes?

Quality of the Limitations: 15%

• Did the limitations clearly and concisely articulate the forensic boundaries of the artefact?

Quality of the Citations: 10%

• Did the citations support an accurate technical analysis?
• Was the APA citation style used in both the text and bibliography?
• Was an appropriate number of citations provided (at least five)?

Quality of Communication: 10%

• Was the report free of spelling and grammatical errors?
• Was the report of an appropriate length?
• If applicable, was any auxiliary content (i.e. figures, referenced data, tables etc.) used

effectively?

Assessment Requirements Brief Summary

The task was to prepare a research report (5–6 pages), worth 25% of the total course grade, focusing on one Microsoft Windows artefact from a given list. The purpose was to investigate how the chosen artefact can be exploited during digital forensic investigations.

The report needed to include:

• Abstract (~300 words) – summary of research purpose, methods, findings, and conclusions.

• Introduction (~400 words) – background of the artefact, scope, and significance.

• Technical Analysis (~2000 words) – detailed breakdown of internal data structures, artefact implementation, and forensic importance.

• Limitations (~300 words) – boundaries and challenges of forensic use.

Assessment Criteria (weightage):

• Abstract (15%)
• Introduction (15%)
• Technical Analysis (35%)
• Limitations (15%)
• Citations (10%)
• Communication Quality (10%)

Learning Outcomes Addressed:

• LO2: Use of open-source forensic tools and techniques.
• LO3: Exploiting forensic value of Windows artefacts using first principles.
• Graduate skills: independent research, information evaluation, and effective communication.

Step-by-Step Mentorship Approach

The academic mentor guided the student systematically through the following process:

1. Understanding the Task & Choosing Artefact

   • Mentor clarified the requirements and marking rubric.

   • Helped the student shortlist and select a Windows artefact based on interest and research availability (e.g., Prefetch files).

2. Planning & Structuring the Report

   • Mentor guided the student to break down the report into the four compulsory sections.

   • An outline was created to ensure proper word allocation across Abstract, Introduction, Technical Analysis, and Limitations.

3. Conducting Independent Research

   • Student was encouraged to gather scholarly articles, open-source forensic blogs, and technical documentation.

   • Mentor emphasized evaluating reliability of sources and cross-verifying technical claims.

4. Writing the Abstract & Introduction

   • Mentor explained how to write the abstract last (after completing analysis) to ensure it covers purpose, findings, and conclusions.
   • In the introduction, the student was guided to cover

     artefact purpose, system role, forensic relevance, and scope of research.

5. Technical Analysis Development

   • This was the core section. Mentor explained:

     • How to describe internal data structures (headers, metadata, time stamps).
     • How to demonstrate forensic value (evidence of execution, file paths, timeline reconstruction).

     • How to present findings clearly with diagrams/tables.

   • The student was also shown how to reference tools (e.g., FTK Imager, Autopsy, or open-source parsers) to validate interpretations.

6. Discussing Limitations

   • Mentor encouraged critical reflection: e.g., “What can’t this artefact reveal? Under what conditions is it unreliable?”

   • Student identified scenarios like artefact deletion, OS version differences, encryption issues.

7. Final Refinement & Citations

   • Mentor reviewed the draft to ensure APA referencing consistency.
   • Emphasis was placed on grammar, flow, and aligning with the assessment criteria for maximum grade potential.

Outcome & Learning Objectives Achieved

• The final report successfully met the required format and length, with each section clearly addressed.

• Student demonstrated:

  • LO2 – Applied forensic tools and methods in research.
  • LO3 – Explained forensic significance of Windows artefact structures.
  • Graduate skills – Independent research, critical evaluation, structured academic writing.

Key Learnings for the Student:

• How to structure a research report in forensic studies.
• How to balance technical detail with academic communication.
• Importance of critical evaluation (not just describing, but assessing limitations).
• Gained confidence in independent forensic research and use of open-source resources.

Get Expert Help with Your Assignments

Looking for reliable academic support? You can download this sample solution to understand how to structure and present your own research effectively. Remember, this file is provided strictly for reference purposes only submitting it as your own work may lead to plagiarism issues.

If you want to secure better grades without the risks, our team of professional academic writers can create a custom-written, plagiarism-free solution tailored to your requirements. Each paper is crafted from scratch, aligned with your university guidelines, and checked with advanced plagiarism detection tools.

Why Choose a Fresh Solution?

• 100% original and plagiarism-free content
• Written by subject-matter experts
• Properly referenced with credible sources
• Tailored to your specific instructions and marking rubric
• On-time delivery with guaranteed confidentiality

Take control of your grades the smarter way learn from the sample, and when it counts, trust our experts to deliver the work you need.