To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items.
This key provides a chronological list of files, often including the and the time they were accessed. Folder: 1
: The registry key NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files a user has recently opened. To track a user's recent activity, forensics experts