Windows Forensics | Last open, Last saved File
Digital Forensic artifacts are that we rely upon. Nowhere is this more true than in the Windows Registry. With no specification and even Microsoft products not following any data storage methodology, it is about as haphazard and irregular as they come. As an example, let’s look at the OpenSaveMRU and LastVisitedMRU Registry keys. Both have …