Tag: c:\users\user\AppData\Roaming\Microsoft\Windows\Recent
-
Recent Files & Directories: Collecting Evidence
Intro During an incident, it is imperative to gather as much information as possible to establish a comprehensive timeline of events. One crucial aspect of information collection is identifying the most recent files and directories on the impacted host found in %AppData%\Roaming\Microsoft\Windows\Recent. This information plays a crucial role in helping to understand the sequence of […]