1: Folder:

: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed.

: Used to load hives like NTUSER.DAT and SOFTWARE to view human-readable data from otherwise complex registry files. Folder: 1

: Essential system files located in C:\Windows\System32\Config (for system-wide settings) and the user's profile directory (for user-specific settings like NTUSER.DAT ). 📝 Common Investigation Steps : Use artifacts like Prefetch or ShimCache (AppCompatCache)

To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items. Folder: 1