Folder: 1 Page

: Search for specific suspicious filenames (e.g., Changelog.txt ) or tools (e.g., mimikatz ) within the registry or common user folders.

To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items. Folder: 1

: A command-line tool often used in conjunction with batch files to quickly extract specific artifacts from registry hives. : Search for specific suspicious filenames (e

: These are found in the UsrClass.dat hive and track a user's browsing history within File Explorer. They store information about which folders were opened, their window size, and their view settings, even if the folder has since been deleted. Changelog.txt ) or tools (e.g.