# Non-Volatile Memory Forensic Analysis in Windows 10 IoT Core
## 5 Forensic Evidence in Windows 10 IoT Core
### Directories
#### 5.2.2 MainOS  
Due to its condition of system root, it is one of the key elements that have to be studied in this system. All the information that it contains is system-configuration-centered, meaning that there are a lot of useful files such as logs, registries and packages installed, but there is not much relevant data regarding the action of the users, as can be observed in Table 2.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{227.6 pt}} \hline \hline
**Directory** & **Description** \\ \hline boot & Installation boot files. \\ \hline EFI & Contains the booting information and settings for the operating system startup process. We can find the bootloader for the ARM architecture and the boot configuration data. \\ \hline System Volume Information & Folder used by the system to store its information and the restore points. \\ \hline Users & Directory in which information about the system’s users is stored. Here we can find that a user account under the name “default” exists, but no relevant material is found in it, including the NTUSER registry. This user profile is used as a template when creating new users, which will be built based on the “default” profile. \\ \hline Windows & Typical Windows system structure directory. Information about specific IoT and ARM packages can be found, but nothing relevant as no usage information is stored in this partition. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Directories in the EFIESP partition.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{227.6 pt}} \hline \hline
**Directory** & **Description** \\ \hline \multirow{2}{*}{\$Extend & Folder that contains metadata and optional extensions regarding the NTFS filesystem. \\ \hline Data & It is a symbolic link to the Data partition, known in NTFS as a junction point. \\ \hline Program Files & Directory to store the information of the programs that are installed on the system. This folder is not used for this purpose in this operating system, as the programs are installed on the “Data” partition. \\ \hline ProgramData & Folder used for application data that is not user-specific, that is to say, the information is available for every account in the system, so all the information of the programs that are shared between the users is stored in this directory. It has no forensic value as the “ProgramData” directory on the “data” partition stores most of the information. \\ \hline PROGRAMS & Folder typically used on Windows 10 Mobile to store the preloaded apps in the system, although there is no information stored in it in the IoT operating system. We can find the folder used to update the system,“UpdateOS”. \\ \hline System Volume Information & Folder used by the system to store its information and the restore points. \\ \hline SystemData & Contains a directory named “Temp” with no information in it. \\ \hline \multirow{2}{*}{Users} & Local information of the users can be found here. There is a “default” user used for the start menu and tiles design, and a “public” directory for the namesake user, but they are empty. \\ \hline \multirow{6}{*}{Windows} & As this partition behaves as the system directory, the Windows folder contains information about the packages installed, drivers, executables, libraries and relevant forensic artifacts such as the system registry hives and the system event logs, among other data. There is also a directory in “System32” named “LogFiles” in which a log about the connections made to the webserver can be found. \\ \cline{1-1} \cline{2-2}  & \(\sim\) 10