Appendix 1 - Windows 10 Artifact Locations Camera App Photos stored at File Format Shared photos Registry
track to user at RecentDocs for .jpg at:
C...
Appendix 1 - Windows 10 Artifact Locations Camera App Photos stored at File Format Shared photos Registry
track to user at RecentDocs for .jpg at:
C:\Users\\Pictures\Camera Roll WIN_20151106_10_48_48_Pro.jpg - WIN / Date in YMD / Time HH_MM_SS / Pro.jpg NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU NTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.jpg
Jump Lists C:\Users\\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations Jump Lists Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs Common App IDs
AutomaticDestinations MSPaint File Explorer-Virtual IE Version 11 Microsoft Access Wordpad File Explorer Control Panel Windows Store Notepad Edge Browser Windows Photo Zune Music App Excel 2013 PowerPoint 2013 Adobe Acrobat Reader File Explorer Word 2013
DestList Jump Lists Registry
AutomaticDestinations CustomDestinations TaskBar Application List
Mail location; 0=Windows Phone Mail, 2=Contact Data, 3=Mail, 5=Calendar, 7=Attachments Full mail storage C:\Users\\AppData\Local\Comms\Unistore\ Temporary mail C:\Users\\AppData\Local\Comms\UserDataTempFiles\
Office Applications CentralTable.accdb Graphics Link Files Log File Information Metadata Metadata Registry Registry
Using Word as example DB tracking Office docs In Word document Office only Microsoft Office Alerts Actual data in Word Document Info Identity Live Account MRU Non Live Account