You have to register to see it, but this is a SANS poster which summarizes common Windows forensic artifacts and what data can be obtained from them:

https://www.sans.org/posters/windows-forensic-analysis/