IT Forensics – Windows

Forensic analysis of the Windows font cache – clues regarding document and programme usage

The Windows font cache is used to optimise the display of installed fonts. As part of an IT forensic investigation, the associated cache files can provide additional evidence regarding the use of specific applications, documents or fonts.

Enquire without obligation

The font cache does not, as a rule, have any evidential value in its own right. Its significance stems rather from its correlation with other artefacts such as file system traces, prefetch files, jump lists, registry entries and event logs. Only a comprehensive analysis enables a reliable technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of font cache files, evaluation of installed fonts, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Document forensics
•Reconstruction of user activities
•Malware investigations
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, any font cache artefacts are identified, analysed and technically categorised alongside other digital traces.

Why is the font cache important?

The font cache can provide additional clues regarding the use of specific applications or documents, thereby contributing to the overall reconstruction of a digital scenario.

Frequently Asked Questions

What information does the font cache contain?+
Depending on the version of Windows, information about cached fonts and their use.
Can a document be unequivocally identified on this basis?+
No. The font cache does not, in itself, constitute conclusive evidence and is always assessed within the overall context.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Is the font cache relevant in a court of law?+
It can form part of a comprehensive forensic assessment as a supplementary artefact.

LanCologne – Windows Forensics in Cologne

LanCologne helps you carry out a legally admissible analysis of the Windows font cache and objectively reconstruct digital user activities.

Get in touch now