FINDING FORENSIC EVIDENCE IN THE OPERATING SYSTEM’S GRAPHICAL USER INTERFACE