A Layered High-Value Evidence Area (HVEA) Model for Selective Windows Digital Forensics Imaging: NIJ-Aligned Design and Empirical Validation

Digital forensics increasingly operates under extreme data growth, where exhaustive bit-wise imaging of modern storage is constrained by time, storage, and processing cost. Selective imaging and artifact prioritization methods reduce acquisition volume, but they typically order artifacts by content, location, or offense type rather than by the relationships that make evidence interpretable. As a result, they risk discarding the contextual artifacts on which attribution and corroboration depend. This paper introduces the High-Value Evidence Area (HVEA) pyramid, a dependency-oriented abstraction that organizes Windows forensic artifacts into ten operational layers (A–J) grouped into four evidentiary tiers: attribution anchor, primary payload, behavioral contextualization, and structural corroboration, in which acquisition order follows interpretive prerequisites rather than artifact salience. The model is evaluated on nine Windows forensic images spanning Windows XP, Vista, and Windows 11, combining retrospective analysis of the M57-Patents corpus with a controlled fourteen-day behavioral experiment. Across systems and operating system generations, HVEA layers exhibit stable evidentiary function despite changing artifact implementations; behavioral execution telemetry persists even where user content is sparse or deliberately concealed; and a three-source timestamp corroboration pattern consistently converges within thirty seconds across independent OS mechanisms, providing an empirically grounded defensibility threshold for event reconstruction. The results support a dependency-ordered, NIJ-aligned selective acquisition strategy that preserves interpretive context while reducing acquisition footprint by approximately 95% (a 15–20× reduction) on the controlled Windows 11 image. The present evaluation is scoped to Windows environments; extending the tier mappings to other platforms is identified as future work.