Windows Forensics DPAPI Registry Memory artifacts Prefetch files Hibernation files MFT Table List of Useful Tools