The registry keys and values used by Windows to manage the display order of the Start Menu and IE Favorites menu present the forensic investigator the opportunity to uncover evidence of previously removed applications and favorites. In several realistic usage scenarios, significant artifacts may be left in these locations indefinitely. An investigator interested in the prior presence of a specific application would do well to test that application and determine what registry artifacts are left behind after the application is uninstalled, as some applications leave more artifacts behind than others.

By Kurt Aubuchon