Data Accessed What is the Microsoft Office MRU Registry Artifact? What is a Windows Recents Folder Artifact? What is a Windows OpenSave MRU Artifact? Logon Artifacts Windows Terminal Services – Local Session Manager Log Local Session Manager – Event 24 (Disconnect) Local Session Manager – Event 23 (Logoff Succeeded) Local Session Manager – Event 22 (Shell Start) Local Session Manager – Event 21 (Logon) Windows Terminal Server – Remote Connection Manager Log Remote Connection Manager – Event 1149 Remote Connection Manager – Event 261