Initially Windows 8 had a workstation and server edition. The server edition became Windows Server 2012.
The following new features were introduced in Windows 8:
The file system used by Windows 8 is primarily NTFS.
The Resilient File System (refs) was initially available in the Windows 8 server edition but became part of Windows 2012 server edition.
Jump Lists are Task Bar artifacts that were first introduced on Windows 7 and are also available on Windows 8.
The prefetch hash function is similar to Windows 2008.
The Windows Prefetch File Format was changed on Windows 8.1 to version 26. (note this could be Windows 8 as well but has not been confirmed)
The Windows Registry remains a core component of the Windows operating system.
Application Experience and Compatibility
On Windows 8 Amcache.hve replaces RecentFileCache.bcf and uses the Windows NT Registry File (regf) format. A common location for Amcache.hve is:
- Features new to Windows 8, Wikipedia
- Windows 8 Forensics - part 1
- Windows 8 Forensics - part 2
- Windows 8 Forensics - part 3
- Windows 8 Registry Forensics
- Windows 8 Forensic Guide, by Amanda C. F. Thomson, 2012
- Forensic Focus: Windows 8 Forensics - A First Look, Presentation, Slides, by Josh Brunty, August 2012
- Windows 8: Tracking Opened Photos, by Jason Hale, March 8, 2013
- Windows 8 and 8.1: Search Charm History, by Jason Hale, September 9, 2013
- Amcache.hve in Windows 8 - Goldmine for malware hunters, by Yogesh Khatri, December 4, 2013
- Amcache.hve - Part 2, by Yogesh Khatri, December 16, 2013
- SRUM forensics, by Yogesh Khatri