2015-03-23 system cleaner Chrome 14:18:10 2015-03-23 Chrome how to recover data 14:18:30 2015-03-23 data recovery tools Chrome 14:19:03 2015-03-23 Chrome apple icloud 15:55:09 (https://www.google.com/webhp?hl=en#hl=en&q=apple+icloud) 2015-03-23 google drive Chrome 15:56:04 (https://www.google.com/webhp?hl=en#hl=en&q=google+drive) 2015-03-24 Chrome security checkpoint cd-r 17:06:50 (https://www.google.com/#q=security+checkpoint+cd-r) 2015-03-25 anti-forensic tools IE 11 10:46:44 2015-03-25 eraser IE 11 10:46:54 2015-03-25 ccleaner IE 11 10:47:51 Considerations - Web browser logs List all user keywords at the search bar in Windows Explorer. (Timestamp, Keyword) Possible Answer Timestamp Search Keyword (Timezone is applied) 2015-03-23 14:40:17 secret Considerations HKU\informant\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery\ - can be inferred from a timestamp of the ‘Timestamp’ parent key (‘WordWheelQuery’). - may not be accurate because it depends on the update mechanism of Windows Explorer. ‘Timestamp’ What application was used for e-mail communication? Possible Answer Microsoft Outlook 2013 Considerations HKLM\SOFTWARE\Classes\mailto\shell\open\command (Microsoft Outlook) HKLM\SOFTWARE\Clients\Mail (Microsoft Outlook) HKU\informant\Software\Microsoft\Office\15.0\Outlook …
2015-03-23 14:18:10 system cleaner Chrome 2015-03-23 14:18:30 how to recover data Chrome 2015-03-23 14:19:03 data recovery tools Chrome 2015-03-23 15:55:09 apple icloud (https://www.google.com/webhp?hl=en#hl=en&q=apple+icloud) Chrome 2015-03-23 15:56:04 google drive (https://www.google.com/webhp?hl=en#hl=en&q=google+drive) Chrome 2015-03-24 17:06:50 security checkpoint cd-r (https://www.google.com/#q=security+checkpoint+cd-r) Chrome 2015-03-25 10:46:44 anti-forensic tools IE 11 2015-03-25 10:46:54 eraser IE 11 2015-03-25 10:47:51 ccleaner IE 11 Considerations - Web browser logs List all user keywords at the search bar in Windows Explorer. (Timestamp, Keyword) Possible Answer Timestamp (Timezone is applied) Search Keyword 2015-03-23 14:40:17 secret Considerations HKU\informant\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery\ - ‘Timestamp’ can be inferred from a timestamp of the parent key (‘WordWheelQuery’). - ‘Timestamp’ may not be accurate because it depends on the update mechanism of Windows Explorer. What application was used for e-mail communication? Possible Answer Microsoft Outlook 2013 Considerations HKLM\SOFTWARE\Classes\mailto\shell\open\command (Microsoft Outlook) HKLM\SOFTWARE\Clients\Mail (Microsoft Outlook) HKU\informant\Software\Microsoft\Office\15.0\Outlook …