Tags: volatility 

Rating:

TL;DR :

Chat Application Used -> finding msimn.exe process

Last time the application was used -> userassist plugin and look for the binary

How many unread messages -> Registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail<email address>

Version -> Registry HKEY_CURRENT_USER\Software\Microsoft\Outlook Express\5.0\Shared Settings\Setup

Original writeup (https://semah-benali.me/post/inctf2021/).