Posts tagged: #acquisition

Where ActivitiesCache.db lives for local, Microsoft and work accounts, and how to collect it with its -wal file from images, KAPE, Velociraptor or live systems.