When we want to find a file in computer, we use searching fuction in windows (eg In windows 7 OS, open a windows explorer and type the file name will do).
I am interested in where does this record located in system files. In real case, so we can indentify the interests of the suspect.
The NTUSER.DAT Registry Key - WordWheelQuery stores this user search information in Windows 7
\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
The NTUSER.DAT Registry Key - WordWheelQuery stores this user search information in Windows 7
\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
Thanks very much Vootz! How about windows xp? Cuz I couldn't find WordWheelQuery in xp NTUSER.DAT registry key.
I found it for XP, NTUSER.DAT\Software\Microsoft\SearchAssistant\ ACMru\5603, hope it will help your guys out there.