New versions of Windows 10 certainly seem to be arriving faster than previous Windows incarnations. Each new version offers the potential for new forensics artifacts. Several new artifacts have already been discovered, and there are certainly more out there waiting to be found. The pace at which they have been found and the chaotic ways they are documented - was that new interesting artifact described in one of dozens of popular blogs? or a tweet? or in a webinar? - make it difficult for investigators to keep up. But missing out on the actionable data these artifacts provide can be harmful to investigations, both in terms of time spent and correctness of conclusions. To help alleviate this problem, in this session the presenter will dive into new artifacts that have been discovered in Windows 10, including but not limited to the Windows Timeline Database, the Windows 10 Notification Center, and new registry artifacts like the Background Activity Moderator (BAM) key. Attendees will be taken through the location and structure of each artifact, what type of activity the artifact describes, and how it is useful in an investigative context. These new techniques will leave investigators better armed to analyze modern Windows systems.