Folder: 1 -

: Search for specific suspicious filenames (e.g., Changelog.txt ) or tools (e.g., mimikatz ) within the registry or common user folders.

: Determine how many user-created accounts exist by checking the SAM hive. Folder: 1

To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items. : Search for specific suspicious filenames (e

: Essential system files located in C:\Windows\System32\Config (for system-wide settings) and the user's profile directory (for user-specific settings like NTUSER.DAT ). 📝 Common Investigation Steps Changelog.txt ) or tools (e.g.

: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed.