EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition
by Steve Bunting
Recent Folder
When I discussed link files, I described how whenever a user opens a document, a link file is created in the Recent folder located in the root user folder, except for Windows Vista and beyond where it is located in the path C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Recent. The user is unaware that this file is being created or modified. If the same document in the same location is later reopened, the link file is updated with the target file’s updated information.
The purpose of the Recent folder is to provide a user interface that lists documents the user has recently created or modified. You can access this interface by clicking the Start button and then selecting My Recent Documents (older versions of Windows) or ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access