: The registry key NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files a user has recently opened.
: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed. Folder: 1
: Used to load hives like NTUSER.DAT and SOFTWARE to view human-readable data from otherwise complex registry files. : The registry key NTUSER
The "detailed write-up" typically utilizes the suite, specifically Registry Explorer , to parse these hives. specifically Registry Explorer
: A command-line tool often used in conjunction with batch files to quickly extract specific artifacts from registry hives.
: Essential system files located in C:\Windows\System32\Config (for system-wide settings) and the user's profile directory (for user-specific settings like NTUSER.DAT ). 📝 Common Investigation Steps
: Determine how many user-created accounts exist by checking the SAM hive.