When examining a Linux system, the settings tend to be embedded in files, while they are often in the registry in Windows. Which is more difficult for the examiner? Why? Are there certain types of artifacts that are easier in one type of system than the other?