Proof of execution in forensics is a fun topic, but it becomes a bit tedious to keep track of all the different places to look in various versions of Windows. So I wanted to quickly save a link out to this table from Adam Harrison (1234n6).