A forensic examiner is tasked with recovering deleted messages from a cloud-based collaboration platform like Microsoft Teams. Which artifact location is most likely to contain recoverable message data on a Windows endpoint?
-
A
Windows Registry HKCU hive
-
B
IndexedDB files in the application's local cache directory
-
C
Prefetch files in C:\Windows\Prefetch
-
D
Browser cookies stored in AppData\Roaming