Windows

How does a DFIR Analyst use evidence artifacts retrieved from Windows operating systems to perform incident investigations, and what are the technologies that can assist in investigations?