Registries function differently between the three main operating systems (Windows, Unix/Linux and MacOS). As a result, digital forensic investigators must examine these systems in different ways to find the bits of evidence left behind by the operating system itself. You will consider forensic evidence located within the three major operating systems.

Compare registry keys (or equivalent information), log files and Internet traces left on different platforms such as Windows, MacOS and UNIX environments.

Discuss how forensic investigators can find evidence on acquired computers. Address the differences if the acquired computers run Windows, Unix and MacOS.