Investigation Scenario 🔎 A workstation’s $UsnJrnl shows a .lnk file created and deleted from %APPDATA%\Microsoft\Windows\Recent\ within 4 seconds, but the referenced file never appears in the MFT. What do you look for next to determine what the user actually opened and whether malicious execution followed? #InvestigationPath #DFIR #SOC