Search notes:

%USERPROFILE%\NTUSER.DAT

NTUSER.DAT is a registry hive and part of a user profile.

When a user logs on, this registry hive is mapped to HKEY_CURRENT_USER.

Apparenty, NTUSER.DAT also records a user's activities such as