Shadow Copies is the one thing you need to add your Forensics activity list.

RDP is that thing you want to investigate...

Bucket machine is a very challenging machine, a real-world-like that uses the Amazon Simple Storage Service (Amazon S3) and DynamoDB