This key provides a chronological list of files, often including the and the time they were accessed.
: Determine how many user-created accounts exist by checking the SAM hive.
: Used to load hives like NTUSER.DAT and SOFTWARE to view human-readable data from otherwise complex registry files. Folder: 1
: These are found in the UsrClass.dat hive and track a user's browsing history within File Explorer. They store information about which folders were opened, their window size, and their view settings, even if the folder has since been deleted.
: Search for specific suspicious filenames (e.g., Changelog.txt ) or tools (e.g., mimikatz ) within the registry or common user folders. This key provides a chronological list of files,
To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items.
: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed. : These are found in the UsrClass
: The registry key NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files a user has recently opened.