Inking and Typing Personalization in Windows 10

In Windows 10, if inking and typing personalization is selected under privacy settings, words added to a spelling dictionary will be saved in a file located in the AppData folder.

The file path should be C:\Users\[UserName]\AppData\Roaming\Microsoft\Spelling\en-US

The file named 'default.dic' will contain words the user adds. The file named 'default.exc' lists the words that have been excluded from the dictionary. 'default.acl' is an autocorrect list.

These files work with modern apps and Internet Explorer, but not the standard MS Office suite.

Digital Corpora's Gov Docs

Digital Corpora, operating under a grant from the National Science Foundation, has posted electronic files here, which can be used to test forensic and electronic discovery techniques.

A thousand separate directories, each with a thousand files, can be downloaded for review. A set of more than 100,000 jpegs is available. The metadata for the files includes search terms; search engines used to find the files; and SHA1 hash values. The files were collected from the United States government. Malware has been deliberately left in the data. The full set includes nearly one million files in a wide variety of formats. One possible drawback is that a very small number of the files (only about 2000) are email files.

Digital Corpora has also posted images made of cell phones, and disk images. PII data has been removed from the disk images. Forensics students can practice with disk images in the EnCase format. These contain information on how data was taken from a fictional businessperson's laptop, and the challenge is to find out if the data was taken by a malicious actor, or intentionally disclosed by the employee.

Screen Capture Devices

Screen capture devices can be used to document digital evidence. Not all data extraction tools can capture information which can be viewed on a smartphone, tablet or computer. Teel Tech's Eclipse tool is an example of such a device. It may useful for reviewing cell phones which forensic tools cannot access data from.