DFIR120 – RunMRU 2019-02-27 (2022-05-15) Mat Episode 06 covers the RunMRU artifact that is particularly useful when investigating RubberDucky attacks.
DFIR120 – Prefetch 2019-02-13 (2022-05-15) Mat This episode of DFIR in 120 seconds covers Windows Prefetch.