06 · User Activity
User Activity Forensics: ShellBags, LNK Files and Jump Lists
Prove which files and folders a Windows user opened, and when: ShellBags, LNK files, Jump Lists, MRU keys, Office Trust Records and Timeline, correlated.
Area 06
User Activity
Knowing that a file existed is not the same as proving someone opened it. This area covers ShellBags, LNK files, Jump Lists, MRU lists, Office trust records, the Windows Timeline and thumbnail caches, and how to correlate them into a who-opened-what narrative tied to one account.
Key sources
- ShellBags
- LNK
- Jump Lists
Guides in this area
06 · User Activity
Browser Forensics on Windows: Chrome, Edge and Firefox
Investigate Chrome, Edge and Firefox on Windows: History, downloads, cookies, sessions, extensions, WebKit and PRTime timestamps, WAL and deleted records.
06 · User Activity
Windows Search Index Forensics: Windows.edb and Windows.db
Mine the Windows Search index for file paths, dates, content snippets, Outlook mail and deleted-file remnants: Windows.edb, Windows.db, tools and pitfalls.
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- ShellBagsShellBags cheat sheet: BagMRU and Bags keys in UsrClass.dat and NTUSER.DAT, shell items, folder timestamps, deleted and USB folders, and parsing with SBECmd.
- LNK shortcut filesLNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
- Jump ListsJump Lists cheat sheet: AutomaticDestinations and CustomDestinations, AppIDs, DestList entries with last access, access count and pin status, and JLECmd.
- RecentDocsRecentDocs cheat sheet: NTUSER.DAT key and per-extension subkeys, MRUListEx order, what the LastWrite time means and how to link entries to LNK files.
- OpenSaveMRU and LastVisitedMRUOpenSavePidlMRU and LastVisitedPidlMRU cheat sheet: ComDlg32 keys per Windows version, what the open/save dialog records, timestamps and upload tips.
- Office MRU and Trust RecordsOffice MRU and TrustRecords cheat sheet: File MRU and User MRU keys per Office version, the [T…] timestamp, and how to spot documents with macros enabled.
- Windows Timeline (ActivitiesCache.db)Windows Timeline cheat sheet: ActivitiesCache.db and WAL, Activity tables, ActivityType values, focus duration, clipboard, 30-day expiry and Windows 11 status.
- ThumbcacheThumbcache cheat sheet: thumbcache_*.db files per Windows version, cache IDs, mapping to the Search index, legacy Thumbs.db and thumbnails of deleted files.
- Browser artifacts (Chrome, Edge, Firefox)Browser forensics cheat sheet: Chromium and Firefox profile files, History and places.sqlite tables, WebKit and PRTime timestamps, downloads, cookies, cache.
- Outlook data files (PST and OST)Outlook PST/OST cheat sheet: data file locations, mail and deleted items, the Content.Outlook attachment cache, profile keys, new Outlook and parsing.
- Notepad TabState (Windows 11)Notepad TabState cheat sheet: Windows 11 Notepad .bin tab files, unsaved text never written to disk, saved file paths, hashes, WindowState and parsing.
- Windows Recall (Copilot+ PC snapshots)Windows Recall cheat sheet: CoreAIPlatform snapshot store, ukg.db and ImageStore, OCR text and window titles, VBS encryption, opt-in status and caveats.
- Print spooler files (.SPL and .SHD)Print spool cheat sheet: .SPL and .SHD files in spool\PRINTERS, EMF content recovery, PrintService event 307, printer drivers and PrintNightmare traces.
- Windows Search indexWindows Search index cheat sheet: Windows.edb (ESE) and Windows 11 SQLite Windows.db, indexed paths, dates and content, deleted records, esentutl collection.
- Clipboard historyClipboard history cheat sheet: what Windows 10/11 keeps in memory, pinned items on disk, cloud clipboard text in ActivitiesCache.db and the registry settings.
- Sticky Notes (plum.sqlite and StickyNotes.snt)Sticky Notes cheat sheet: plum.sqlite Note table and .NET tick timestamps on Windows 10/11, legacy StickyNotes.snt, WAL recovery, collection and parsing.
- Notification database (wpndatabase.db)Windows notification database cheat sheet: wpndatabase.db tables, toast Payload XML, FILETIME ArrivalTime and ExpiryTime, WAL recovery and legacy appdb.dat.
- Desktop messaging apps (Slack, Signal, WhatsApp…)Desktop messaging forensics: where Slack, Signal, WhatsApp, Telegram and Discord keep data on Windows, what is encrypted, timestamps and export options.
- Microsoft Teams (classic and new client)Microsoft Teams cheat sheet: classic vs new Teams data folders, IndexedDB LevelDB messages and call logs, logs, and Purview or Graph exports as the reference.
- OneDrive sync clientOneDrive cheat sheet: account registry keys, SyncEngineDatabase.db and <CID>.dat metadata, ODL logs, SafeDelete.db, Files On-Demand and how to parse them.
- CapabilityAccessManager (camera, mic, location)CapabilityAccessManager cheat sheet: ConsentStore keys, LastUsedTimeStart and Stop for webcam and microphone use per app, and the Windows 11 SQLite database.