Folder: 1 Apr 2026

: Used to load hives like NTUSER.DAT and SOFTWARE to view human-readable data from otherwise complex registry files.

: These are found in the UsrClass.dat hive and track a user's browsing history within File Explorer. They store information about which folders were opened, their window size, and their view settings, even if the folder has since been deleted.

: Search for specific suspicious filenames (e.g., Changelog.txt ) or tools (e.g., mimikatz ) within the registry or common user folders. Folder: 1

: Essential system files located in C:\Windows\System32\Config (for system-wide settings) and the user's profile directory (for user-specific settings like NTUSER.DAT ). 📝 Common Investigation Steps

: Determine how many user-created accounts exist by checking the SAM hive. : Used to load hives like NTUSER

: Use artifacts like Prefetch or ShimCache (AppCompatCache) to prove a file was not just present, but actually executed.

The "detailed write-up" typically utilizes the suite, specifically Registry Explorer , to parse these hives. : Search for specific suspicious filenames (e

This key provides a chronological list of files, often including the and the time they were accessed.