Investigation Scenario 🔎 While reviewing Amcache.hve, you notice C:\Users\Public\Libraries\SyncHost.exe executed once, but no corresponding Prefetch file exists despite Prefetch being enabled. The file is not present at that location. What do you look for to investigate whether an incident occurred? Bonus Exercise: List several of the potential explanations for this behavior #InvestigationPath #DFIR #SOC