NTUSER.DAT Registry Analysis — User execution and knowledge artifacts

Hard GIAC GCFA cybersecurity drill: You are a Digital Forensics Investigator analyzing a compromised workstation at Cascade Logistics. A user account was