ShellBags
Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on removable drives no longer attached.
Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on removable drives no longer attached.
Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.