Additional forensic artifacts exercises

In this part, we will apply what we have learned so far. Try to work on the following exercises:

1. Load your PST file into Kernel PST viewer.
2. Using Security.evtx, explore and track user activity using event IDs 4624 and 4625.
3. Track an application crash using application.evtx.
4. Parse system.evtx using Evtxcmd.exe and save the output into a CSV file.
5. Parse SRUMDB.dat for your local machine using SRUM_DUMP and map network activity using Windows Registry by identifying the profile ID.