tl;dr

• Registry Hives analysis
• Analyse Chrome browser artifacts
• Analyse Slack artifacts
• Analyse AnyDesk artifacts
• Analyse artifacts for evidence of execution
• Analyse clipboard artifacts

tl;dr

• Extract User ID and Workspace ID of the Slack workspace participating.
• Extract the first & last 3 characters of text from the Anydesk Remote connected PC’s thumbnail wallpaper.
• Extract the type of filesystem of the USBs connected to the system.
• Extracting active duration of Voice Modulator application used by parsing Windows Activity timeline.