This is not a book on Windows forensics. Acquiring, imaging, and analyzing Windows data is one of the most developed areas in digital forensics. In this book, we'll be covering major points that make tablet forensics different from the traditional PC and laptop acquisition approach. In this chapter, we'll cover the new Connected Standby mode replacing traditional Sleep and Hibernate modes of Windows laptops, discuss Secure Boot on various Windows tablet platforms, review UEFI BIOS settings, and learn how to start the tablet from a bootable USB media. We'll also cover techniques on capturing the content of the device's RAM and imaging non-removable eMMC media. But first let's have a look at what Windows tablets are and what they aren't.
Things we will not be covering in this book include the general steps to create a bootable USB media (this is well covered elsewhere including official Microsoft sources) and the use of...