A.It tracks changes to firewall settings.

B.It details software installation processes.

C.It logs user login attempts and times.

D.It contains metadata for each file and directory.

A.They can provide details on user access times and the frequency of logon attempts, which can be indicators of unauthorized access or insider threats.

B.They track the use of command-line tools.

C.They log changes to user interface themes.

D.They help identify the use of privilege escalation techniques.

A.File metadata

B.Recycle Bin

C.Prefetch files

D.NTUSER.DAT

E.RecentDocs registry key

A.To compress data for storage efficiency

B.To identify duplicate files

C.To track user access times

D.To verify the integrity of forensic evidence

A.They provide a log of software uninstallation events.

B.They detail the history of connected Bluetooth devices.

C.They track changes in user access levels.

D.They may include tasks set to run software at specific times, potentially for malicious purposes like data exfiltration or launching attacks.