windows investigation