In certain investigations, it may arise that you need to find the following:
-
What process was using the camera or microphone?
-
When was the last session?
-
How long was that session?
Using the contents of the following reg keys, you can determine when and how long a process had access to privacy protected resources. These resources include the microphone, webcam, bluetooth, location, contacts and more. For this blog, I will focus on the microphone and webcam as an example.
