Derived from Digital Evidence Analysis using the Axiom Examine application: LNK FILES ARE MAINLY RECOVERED FROM THE USER’S RECENT FOLDER. WHAT KEY IN THE NTUSER.DAT FILE SHOULD ALSO BE EXAMINED FOR
a) UserAssist
b) RecentFiles
c) AppPaths
d) None of the above