To track a user's recent activity, forensics experts analyze specific registry keys that store "shortcuts" to recently opened items.

This key provides a chronological list of files, often including the and the time they were accessed.

: Used to load hives like NTUSER.DAT and SOFTWARE to view human-readable data from otherwise complex registry files.