Description:
============:
This course will demonstrate evidence of forensic value contained within the system hive file.

Full Description:
================:
This course explores the system hive file showing how to determine the current control set, computer name, last shutdown date and time, crash dump settings and location, services set to run at startup, page file settings, prefetch settings, last access file time settings, AppCompat Cache, BAM (background activities monitor) and USB device connections and disconnections with dates and times.