keydet89 wrote:
minime2k9 wrote:
Have you had a look in the Shellbags?
If its a Windows 7 machine , the usrclass.dat file can contain information about folders which have been accessed, which could be useful.
How so?http://www.williballenthin.com/forensics/shellbags/index.html
See section under "folderdata".
Did have a better link but can't find it now <img src="images/smiles/icon_sad.gif" alt="Sad" title="Sad" />
↧