Me: "When in use, Windows Remote Desktop caches images of the display of the connected machine. This is done to improve performance. This cached data can be viewed with software to possibly recover information on previously connected machines and activities done on them."
Twitter engagement bait slop:
Step 1: Search Windows digital forensic artifacts on Google
Step 2: Find popular artifact example (Prefetch, RunOnce, SRUM...)
Step 3: Write engagement tweet
Step 4: Repeat as such
Step 5: ???
Step 6: PROFIT!!!
I say this but my first post on final.st is about the terminology behind forensic data extraction on phones. What a hypocrite. (whoops. spoiler.)
I'm just wondering if I can use this on a pen test 🤔
