Can Google Gemini 2.5 Pro Write Forensic Training Materials?

I've been eagerly waiting for an AI model with the right amount of context window to help create comprehensive forensic training materials and cheat sheets. One tool that has garnered significant attention in this regard is Google Gemini, boasting one of the largest context windows at 2.5 million. Determined to put its capabilities to the test, I decided to see how many Windows 11 artifacts related to program execution it could list.

The Challenge: Listing Forensic Artifacts by Type

My goal was to create a comprehensive list of forensic artifacts specific to Windows 11, grouped by type. This would enable an AI model like Google Gemini to assist in the creation of DFIR (Digital Forensics and Incident Response) training materials and cheat sheets. With the right context window, such a model could process vast amounts of data and provide relevant information to investigators.

The Result: A Comprehensive List of Windows 11 Forensic Artifacts

After running Google Gemini through its paces, I'm pleased to report that it performed admirably. Below is the table outlining Windows 11 forensic artifacts related to program execution, as per my requirements:

A Link to the Full List: Windows 11 Forensic Artifacts by Type

For those interested in exploring the full list of forensic artifacts, I recommend checking out the link above. This will take you directly to a Google Sheets version of the table, where you can review and expand upon the information provided.

A Conclusion: Potential for AI-Assisted Training Materials

Google Gemini's performance in listing Windows 11 forensic artifacts by type demonstrates its potential as an AI model for assisting in the creation of DFIR training materials. While there is still room for improvement, this achievement showcases the capabilities of current models and invites further exploration into their applications.