The importance of computer forensic reviews carried out to detect crimes committed on the Internet and information systems is be better understood day by day. In this regard, it is very important to obtain digital evidence in accordance with the law in the detection of crime and criminals. In computer forensic investigation, digital evidence can be obtained by many different methods. Operating systems, especially those used on information systems, are a very good example. It is the most preferred Windows operating system in both personal and corporate structures in our country as it is on a global scale. For this reason, the intensity of the crimes committed and the victimization experienced in the virtual world is on this system. Therefore, this study carries out the forensic work on the Windows operating system. Current studies in the field of forensic informatics contribute to the literature mostly as a conceptual and legal arrangement. However, this paper aims to do forensic work with Windows PowerShell and third party software by using methodological and technical analysis together. Thus, digital evidence on system components has been analyzed using methodological and technical methods, and the results obtained have been presented with visual data.