1: Folder:

: Essential system files located in C:\Windows\System32\Config (for system-wide settings) and the user's profile directory (for user-specific settings like NTUSER.DAT ). 📝 Common Investigation Steps

To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items.

: Determine how many user-created accounts exist by checking the SAM hive. Folder: 1

: The registry key NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files a user has recently opened.

: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed. : The registry key NTUSER

: A command-line tool often used in conjunction with batch files to quickly extract specific artifacts from registry hives.

This key provides a chronological list of files, often including the and the time they were accessed. This key provides a chronological list of files,

: These are found in the UsrClass.dat hive and track a user's browsing history within File Explorer. They store information about which folders were opened, their window size, and their view settings, even if the folder has since been deleted.