Question
Which artifact is most useful for reconstructing Windows user activity?
Select an option. Your answer will be checked instantly.
Correct Answer: A. Registry and event logs
Explanation:
Registry and event logs often contain user and system activity traces.
Leave a Reply