esb - Paiet/FOR---Operating-System-Forensics GitHub Wiki

user software current version explorer mru list term search for last charms contergures will be stored in a file side_ or s80_

• add user
• charms are stored in txt. site s80 .lnk only one file qill be inlouded for the first term this ferutres needs to remain enabled

windows.add conetents of text contiane no more than 8 kb delewted datas from sd files will be here

recentdocs

• key containes all file user oppend
• containe mruy list of the order of files oppend in system

esd database don't extract using ftk

systemsearch autosum -all stored in windows .edb