drop ntuser.dat or software hive · extract mui cache · program execution history · friendly names · timestamps · runs locally
drop ntuser.dat or software hive — parses Shell\\MuiCache values