digitalcoroner wrote:
I'm trying to determine if workstation was used to download/burn the Live CD.
Such things are usually downloaded as an ISO file, so check for such files within the active file system, as well as unallocated space.
Depending upon the version of Windows, I'd check the RecentDocs and ComDlg32 Registry keys for the user, as well as Jump Lists. Also check the download history for any browsers used via the user account.
↧