In certain investigations, it may arise that you need to find the following:
What process was using the camera or microphone?
When was the last session?
How long was that session?
Using the contents of the following reg keys, you can determine when and how long a process had access to privacy protected resources. These resources include the microphone, webcam, bluetooth, location, contacts and more. For this blog, I will focus on the microphone and webcam as an example.