DFIRHub

Windows registry artifactCloud-related Folders

Displays evidence of cloud-related folders that exist or have existed previously

  • Cloud Storage
  • 1 key
  • DEFAULT

Registry keys

1 key that RECmd reads for this artifact

  • DEFAULTrecursive
    Software\Microsoft\Windows\CurrentVersion\StorageSense\SuggestedFolders\*\Suggestions\*

    Displays evidence of cloud-related folders that exist or have existed previously

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)