06 · User Activity
User Activity Forensics: ShellBags, LNK Files and Jump Lists
Prove which files and folders a Windows user opened, and when: ShellBags, LNK files, Jump Lists, MRU keys, Office Trust Records and Timeline, correlated.
Articles tagged: #user-activity
06 · User Activity
Browser Forensics on Windows: Chrome, Edge and Firefox
Investigate Chrome, Edge and Firefox on Windows: History, downloads, cookies, sessions, extensions, WebKit and PRTime timestamps, WAL and deleted records.
06 · User Activity
Windows Search Index Forensics: Windows.edb and Windows.db
Mine the Windows Search index for file paths, dates, content snippets, Outlook mail and deleted-file remnants: Windows.edb, Windows.db, tools and pitfalls.