Identifying and finding forensic evidence from Windows application

This paper presents the method of identifying and finding forensic evidence from the volatile memory of Windows computer systems. This is a scenario-based investigation on what amount of user input can be recovered when application is opened and images are captured at set interval while Windows system is still actively running. This approach of digital investigation revealed the extracted evidence of user input stored and as dispersed on the application memory of Windows system. In this experiment, the result shows a coherent view of user input on some commonly used applications with over 39% of user input stored on MS Access and 44% was stored on Excel. The quantitative assessment of user input will be presented on the basis of the repeated number of user input recovered, the percentage of user input found and the length of evidence found in a continuous block of the application memory