decrypting…# Windows Forensics > Windows forensics is the process of examining the digital evidence left behind on a Windows system to understand what occurred on the machine, how it happened, and who or what was responsible. It involves analysing artefacts such as event logs, registry entries, file activity, user actions, memory data, and application traces to reconstruct timelines, detect malicious behaviour, and support incident response or legal investigations.