Logpresso Forensic

NTFS journal

Windows Timeline

UltraVNC connection

TeamViewer

Text

TightVNC connection

SRUM network usage

SRUM push notification data

SRUM long-term energy usage

SRUM network connections

SRUM application resource usage

SRUM energy usage

Registry

Recycle bin

Windows user folders

Windows program execution

Windows IE typed URLs

Windows USB device connections

Windows user accounts

Scheduled task settings

Windows time zone

Windows Tracing

Windows accessed folders

SRUM settings

Windows recent run commands

Windows services

Installed programs

Windows recent open and save

Windows install info

Windows network profiles

Office document locations

HWP documents

Windows Remote Desktop connections

Windows environment variables

Windows Explorer searches

Windows drivers

Adobe Reader

Windows autorun

Prefetch

RealVNC connection

PowerShell console log

NTFS file entry

Linux I/O load

LNK file

Linux users

Linux user groups

Linux services

Linux timers

Linux login sessions

Linux system info

Linux rootkit hunter

Linux routing table

Linux shell commands

Linux partitions

Linux processes

Linux login history

Linux network interfaces

Linux open files

Linux failed logins

Linux files

Linux network connections

Linux cron jobs

Linux environment variables

Linux ARP cache

Legacy IE history

IP address

IE cookies

Legacy IE cookies

Firefox add-ons

hosts file

Task Scheduler execution

Windows account logon

RDP local inbound connection

RDP remote inbound connection

RDP client connection

MTP usage

Removable device attach and detach

PowerShell script

ETL file

Chrome cookies

Chrome extensions

Domain

Browser downloads

Website visits

Browser searches

ALYac

Windows Error Reporting

WMI OBJECTS.DATA

URL

Syscache

Winlogon

SHA1

AppCompatCache

RecentApps

RecentDocs

Port Monitors

Print Processors

LEGACY_

MUICache

ComDlg32 CIDSizeMRU

ComDlg32/FirstFolder

ComDlg32/LastVisitedPidMRU

AppCompatFlags

BAM

RecentFileCache

Active Setup

MD5

PCAP

LastActivityView

WinRM

PowerShell

BITSAdmin

Program-Compatibility-Assistant

EML

Amcache

Autoruns