Host Artefacts

🎞 Media Files

Windows Recent documents Key 🔑: NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs Contains the list of all recent documents as a bunch and also the same data sorted by extension.

💬❗️Notifications

Windows Toast notifications on Windows 10: C:\Users\%Username%\AppData\Local\Microsoft\Windows\Notifications contains wpndatabase.db and appdb.dat. Both can be opened with 🛠 SQLite Browser.

🗣 Voice Assistants

Windows Cortana is a great source of information. C:\Users\%Username%\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\ESEDatabase_CortanaCoreInstance\CortanaCoreDb.db contains user locations, reminders etc. Use a 🛠 SQLite browser to see the contents, or export to cvs and work in Excel.

🌞 OS Core Processes

This is about … .

🏃🏼‍♀️ Evidence Of Installation And Execution

📈 User Statistics

This is about … .

📜 File Forensics

📨Recent Files And Folders

🔦 Search History

This is about … .

🦠AV Files

This is about … .