Reconstructing User Activity for Forensics with FeatureUsage

This report describes the Windows 10 FeatureUsage registry artifacts located at NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage and how each subkey—AppBadgeUpdated, AppLaunch, AppSwitched, ShowJumpView, and TrayButtonClicked—records taskbar-related actions. It explains how these entries can be leveraged in digital forensics and incident response to reconstruct user activity and evidence of execution (e.g., app launches and switches indicative of tools like Mimikatz).