This week I talk about the artifacts and methodology for examining user activity on Windows systems.