Folder: 1 (90% FULL)

: The registry key NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files a user has recently opened.

: In File Explorer, switching to the Details view can reveal critical metadata such as "Date Created" and "Date Modified". Folder: 1

: Used to load hives like NTUSER.DAT and SOFTWARE to view human-readable data from otherwise complex registry files. : The registry key NTUSER

: Search for specific suspicious filenames (e.g., Changelog.txt ) or tools (e.g., mimikatz ) within the registry or common user folders. Changelog.txt ) or tools (e.g.

: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed.