±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35520
New Yesterday: 1 Visitors: 107

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

User Assist

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

ClarkK
Newbie
 

User Assist

Post Posted: Apr 19, 19 13:59

Can someone provide a short, brief description of what User Assist is? From what I understand, it is a set of registry keys that track program execution. Would like to hear from forensic folks rather than generic forums.  
 
  

jaclaz
Senior Member
 

Re: User Assist

Post Posted: Apr 19, 19 15:23

blog.didierstevens.com...serassist/


Windows Explorer displays frequently used programs on the left side of the standard XP Start menu.
The data about frequently used programs is kept in the registry under this key:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist


Besides the above program, also:

www.nirsoft.net/utils/..._view.html

Some details on the format of the keys used:
windowsexplored.com/20...n-windows/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

randomaccess
Senior Member
 

Re: User Assist

Post Posted: Apr 21, 19 05:33

Good way to track GUI program executions  
 

Page 1 of 1