From the movement you log into a computer, it will start recording your activities. It can be your username and password, files that you created, edited or deleted, websites you have visited, or applications and information you downloaded. In Windows XP, Vista and 7 these are the common information that get recorded. Windows 8 is gathering more information than those which I mentioned before. It will gather your email contacts, social network contacts, status updates, profile pictures, location details and many more. So, you will be leaving traces behind. Amanda Thomson from The George Washington University studies all the possible areas that will help a forensic examiners to recreate the user behaviours.

In windows 8 all the user data is recording inside the  AppData\Local folder.  All the application data will have its dedicate folders to store its last stratus information. For Example Metro Apps that are displayed on the metro interface is saved in Microsoft\Windows\Application Shortcuts, Internet Explorer 10 web history will be saved under Microsoft\InternetExplorer\Recovery\Immersive\Active and list goes on and on. These are common user data that is been collected.

If you have administrator control and have couple of  forensic tools, you can access user contact list with their images. These information is not encrypted as well. It seems like a mess, but it is not a security threat.

Read Windows 8 Forensic Guide by Amanda Thomson.