Notifications
Clear all
Topic starter
I'm using Encase, the evidence file got two folder: important and secret, i want to find out the user account access these two folder from 2020 Nov.1---2020.Nov.20. and what are subfolders and files that user access, is it possible to be done in encase?
Posted : 18/05/2021 3:02 pm
Each time that you open a file from Windows Explorer or from a standard open/save dialog-box, the name of the file that you opened is recorded by the (Windows) operating system. Some of the names are saved into the 'Recent' folder. Other are saved into the Registry. Use "RecentFilesView" from Nirsoft. Only the opening is recorded, so if you only access these folders without opening any files, there will be no registration...
Posted : 30/05/2021 6:45 pm