http://forensicmethods.com/control-panel-forensics
http://habrahabr.ru/company/netwrix/blog/221377/