While studying for the GX-FE [1], I started exploring the “Position” value in the registry that helps to tell Microsoft Word where you “left off”. It's a feature many people that use Word have seen on numerous occasions and is explored in FOR500: Windows Forensic Analysis [2].
This article has been indexed from SANS Internet Storm Center, InfoCON: green
Read the original article: