Some programs need to perform specific events at a specific time in the Windows environment. To do this, Windows allows programs to create what is called a scheduled task. Tasks are stored in C:\Windows\System32\Tasks. Each task is stored in the XML file format, which contains the user who created the task, the time or the trigger of the task to take place, and the path to the command or the program that will be executed, which is the task itself. Starting from Task Scheduler 2.0, which was first introduced with Windows Vista, the trigger can be calendar-based or an event, such as starting the task when a specific event is logged to the event log system. The actions can also be: running the program, sending an e-mail, or viewing a message to the user.

In the live system, the investigator can open the tasks using the usual Task Scheduler. From the forensic image, the investigator can extract the tasks from C:\Windows\System32\Tasks, where each file is a single task in the XML...