: To see which applications were executed. Shellbags : To track folder navigation by the user/attacker.
: Search for use of Rclone , Mega.nz , or simple POST requests to suspicious IPs. Mia-HallOfFameN004.7z
: To track file creation and deletion.
: .ad1 (Custom Content Image), .E01 (Expert Witness Format), or raw file system exports. : To see which applications were executed