: If an Outlook PST file is present, investigators look for communications with "competitors" or external email addresses where company secrets might have been sent. Common Solutions (Flags)
: Analysis of .lnk files in the Recent folder shows Erin accessed sensitive documents and external storage devices. Erin D.rar
: Registry keys (like USBSTOR ) reveal that a specific Kingston USB drive was plugged into the machine shortly before the "data leak" occurred. : If an Outlook PST file is present,