Tabla de Contenidos: “…6.3.5 Creation of Timeline of Activity -- 6.3.5.1 Plaso -- 6.3.5.2 Volatility 3 Timeline -- 6.3.5.3 Creating a Super Timeline -- 6.4 Evidence Location -- 6.4.1 System Information -- 6.4.1.1 Time Zone Information -- 6.4.1.2 Network Interfaces -- 6.4.2 Account Usage -- 6.4.2.1 SAM Accounts -- 6.4.2.2 Security Events -- 6.4.2.3 Dead Box Password Cracking -- 6.4.2.4 User Access Logging -- 6.4.3 User Activity -- 6.4.3.1 Search History -- 6.4.3.2 Typed Path -- 6.4.3.3 LastVisitedMRU (Windows common dialog box) -- 6.4.3.4 XP Search -- 6.4.3.5 Thumbnails -- 6.4.3.6 Remote Desktop Protocol (RDP) -- 6.4.4 File or Folder Opening -- 6.4.4.1 Recent Files -- 6.4.4.2 Shortcut (.LNK) Files -- 6.4.4.3 Office Recent Files -- 6.4.4.4 Shellbag -- 6.4.4.5 Open/Save MRU -- 6.4.5 Program and File Execution -- 6.4.5.1 UserAssist -- 6.4.5.2 MUICache -- 6.4.5.3 Windows 10 Timeline -- 6.4.5.4 BAM and DAM -- 6.4.5.5 Amcache.hve -- 6.4.5.6 Jump List -- 6.4.5.7 Last‐Visited MRU -- 6.4.5.8 RecentApp -- 6.4.5.9 Prefetch -- 6.4.5.10 LastVisitedMRU -- 6.4.5.11 Taskbar Feature Usage -- 6.4.5.12 CapabilityAccessManager -- 6.4.5.13 RUN Box Execution -- 6.4.6 External Device/USB Usage -- 6.4.6.1 USB Device Types -- 6.4.6.2 Plugged in USB -- 6.4.6.3 Setupapi -- 6.4.6.4 Plug‐and‐Play Cleanup -- 6.4.6.5 PnP Events -- 6.4.6.6 MTP Device -- 6.4.6.7 User USB Device -- 6.4.6.8 Removable Devices Logs -- 6.4.7 Network Activity Artifacts -- 6.4.7.1 Network Mapping -- 6.4.7.2 Network History -- 6.4.7.3 Network Profiles Key -- 6.4.7.4 IP Address -- 6.4.8 Commands -- 6.4.8.1 Powershell History -- 6.4.8.2 WMI -- 6.4.8.3 WMI Database -- 6.4.8.4 Command Line Event Log -- 6.4.8.5 WMI Event Log -- 6.4.9 Browser Usage Artifacts -- 6.4.9.1 Account Records -- 6.4.9.2 Cookies -- 6.4.9.3 History -- 6.4.9.4 Cache -- 6.4.9.5 Internet Explorer -- 6.4.9.6 Browser Download Manager -- 6.4.9.7 Session Restore…”