Windows Media Playe...
 
Notifications
Clear all

Windows Media Player in Windows 7

3 Posts
3 Users
0 Likes
342 Views
(@ssenyl)
Posts: 25
Eminent Member
Topic starter
 

Hi all,

Trawling my way through my most recent case and thought I'd check to see what has been viewed using Windows Media Player so headed off to the Registry, only to find the the RecentFileList does not appear to be at the normal place (i.e NTUSER.DAT\Software\Microsoft\MediaPlayer\Player).

Very confused…

Anyone have any idea where it might have gone to?

Have tried Google, but can't seem to find anything

Many thanks in advance D

 
Posted : 27/01/2011 9:11 pm
(@slewis72)
Posts: 1
New Member
 

I would like to Re-Charge this thread in hopes of some clarification to ssenyl's request. I too am puzzled by this in Windows 7. I know some of you veterans can answer this….Please.

 
Posted : 16/12/2011 4:04 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

You now have to look to the Jump Lists.

Some good places to start developing an understanding of JLs…

http//www.forensicswiki.org/wiki/Jump_Lists

Full disclosure…I wrote that page. Be sure to click on the link to listing of AppIds at the bottom of the FW page. Also, here's a link to one of the posts on my own blog

http//windowsir.blogspot.com/2011/08/jump-list-analysis-pt-ii.html

Hope that helps.

 
Posted : 23/12/2011 6:23 pm
Share: