File Knowledge can be used to identify whether or not a user was aware of a specific file. We can uncover deleted files from the Recycle Bin, identify windows search history, and view thumbnails of images that were previewed by Windows Explorer.
Last-Visited MRU
Tracks the specific executable used by an application to open the files documented in the OpenSaveMRU key.
Recycle Bin
Review deleted files within the Windows Recycle Bin.
Search - WordWheelQuery
Track keyword searches within Windows.
Thumbs.db
Hidden file in directory where images on machine exist stored in a smaller thumbnail graphic.
Thumbcache
A database containing thumbnails of pictures, documents and folders.