Recovered artifacts should include examples of the following:
- Registry entries describing the system hardware and software
- System and Internet history log files
- MAC time stamps
- Data from different file types from allocated space, file slack space, RAM slack space, and unallocated space