±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36324
New Yesterday: 2 Visitors: 160

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Useful registry key, search strings

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

gmarshall139
Senior Member
 

Useful registry key, search strings

Post Posted: Feb 24, 06 20:12

Look at:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

Below it are two sub-keys:

ContainingTextMRU and FilesNamedMRU

These contain search terms entered in Windows Explorer's search funtion. As you may have guessed, either the "Containing Text" box or the "Files Named" box.

These paths are from a Window's 2000 registry, but I believe they will be the same for XP.
_________________
Greg Marshall, EnCE 
 
  

keydet89
Senior Member
 

Re: Useful registry key, search strings

Post Posted: Feb 24, 06 21:51

Greg,

Windows Explorer, or Internet Explorer?

Also, I believe that with XP, the key you'd be interested in is now:

HKCU\Software\Microsoft\Search Assistant\ACMru\5001, \5603, etc.

Harlan  
 
  

gmarshall139
Senior Member
 

Re: Useful registry key, search strings

Post Posted: Feb 24, 06 23:15

Windows Explorer, and you are correct about the new path.
_________________
Greg Marshall, EnCE 
 
  

gmarshall139
Senior Member
 

Re: Useful registry key, search strings

Post Posted: Feb 25, 06 08:09

Ok, in XP:

HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5001

records Internet Explorer search terms, the other two subkeys (5603, 5604) record Windows Explorer search terms.
_________________
Greg Marshall, EnCE 
 
  

redhat
Newbie
 

Re: Useful registry key, search strings

Post Posted: Mar 21, 06 13:58

Hey,everyone
Why can't I find these key in my windows 2003 system?
_________________
RedHat^_^
-------------------------------
I love my country!!! 
 
  

gmarshall139
Senior Member
 

Re: Useful registry key, search strings

Post Posted: Mar 21, 06 19:21

Perhaps they've changed, I don't have a 2003 system to check it on. An easy way to find it is to enter a very unique search term in your start menu search box. Then open regedit, and search for that term within regedit. Should take you right to it.
_________________
Greg Marshall, EnCE 
 
  

keydet89
Senior Member
 

Re: Useful registry key, search strings

Post Posted: Mar 21, 06 20:18

I don't have the key in my Win2K3 VM session, either...but then, I haven't done any searches on that system.

Okay, I did a search and the ACRMru key appeared.

So...try performing a search. If that doesn't add the subkey, then check the permissions on the key against your account.

Harlan  
 

Page 1 of 2
Page 1, 2  Next