Exhibit 1. Typical Disk Regions

From the article "New Approaches to Digital Evidence Acquisition and Analysis," October 7, 2018.

Typical Disk Regions include: Program files; registry, system metadata (high value); blanks space (never used); Windows OS files; temp files, history, logs (high value).

Source: Martin Novak; Jonathan Grier; Daniel Gonzales, "New Approaches to Digital Evidence Acquisition and Analysis," October 7, 2018, nij.ojp.gov:
https://nij.ojp.gov/topics/articles/new-approaches-digital-evidence-acquisition-and-analysis