Microsoft Word Forensic Artifacts in Windows 10 Registry

Abstract

In the era of digitalization, most of the computer users use Microsoft Word as a primary tool for creating, accessing and modifying associated digital documents. With the rapid increase in the usage of digital devices, Digital Investigations became essential while dealing with deleted, hidden, modified, tempered or stolen documents either in case of an incident or a digital crime. In windows, registry is the core component that keeps track of almost all applications. In this paper, a novel study is carried out specifically on Microsoft Word to figure out its forensics artifacts in Windows 10 registry. The registry locations identified as a result provide clues about a user's interaction with Microsoft Word. These clues not only provide information about documents that currently exist but most importantly about deleted documents as well.