File Knowledge

File Knowledge can be used to identify whether or not a user was aware of a specific file. We can uncover deleted files from the Recycle Bin, identify windows search history, and view thumbnails of images that were previewed by Windows Explorer.

Last-Visited MRU

Tracks the specific executable used by an application to open the files documented in the OpenSaveMRU key.

Recycle Bin

Review deleted files within the Windows Recycle Bin.

Search - WordWheelQuery

Track keyword searches within Windows.

Thumbs.db

Hidden file in directory where images on machine exist stored in a smaller thumbnail graphic.

Thumbcache

A database containing thumbnails of pictures, documents and folders.