Integrations

AmCache

Windows

Tracks programs that have run on a computer, providing a history of application usage.

Event Logs

Windows

The computer's diary, recording important system, security, and application events as they happen.

Jumplists

Windows

Reveals recently opened files, showing a history of a user's document and application access.

MFT

Windows

A master index of every file on the disk, including critical information about deleted files.

Profile Lists

Windows

Identifies every user account that has logged into the computer and their associated profile folder.

PS History

Windows

A command log that reveals specific, advanced actions performed by administrators or sophisticated users.

Recent Lnks

Windows

Automatically created shortcuts that show which files a user has recently opened or accessed.

Shell Bags

Windows

Remembers which folders a user has opened, creating a map of their navigation history.

ShimCache

Windows

A system compatibility record that serves as evidence of which programs have been executed.

SRUM

Windows

Details which applications used network data and CPU time, helping to track internet and program activity.