Useful registry key...
 
Notifications
Clear all

Useful registry key, search strings  

  RSS
gmarshall139
(@gmarshall139)
Active Member

Look at

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

Below it are two sub-keys

ContainingTextMRU and FilesNamedMRU

These contain search terms entered in Windows Explorer's search funtion. As you may have guessed, either the "Containing Text" box or the "Files Named" box.

These paths are from a Window's 2000 registry, but I believe they will be the same for XP.

Quote
Posted : 24/02/2006 8:12 pm
keydet89
(@keydet89)
Community Legend

Greg,

Windows Explorer, or Internet Explorer?

Also, I believe that with XP, the key you'd be interested in is now

HKCU\Software\Microsoft\Search Assistant\ACMru\5001, \5603, etc.

Harlan

ReplyQuote
Posted : 24/02/2006 9:51 pm
gmarshall139
(@gmarshall139)
Active Member

Windows Explorer, and you are correct about the new path.

ReplyQuote
Posted : 24/02/2006 11:15 pm
gmarshall139
(@gmarshall139)
Active Member

Ok, in XP

HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5001

records Internet Explorer search terms, the other two subkeys (5603, 5604) record Windows Explorer search terms.

ReplyQuote
Posted : 25/02/2006 8:09 am
redhat
(@redhat)
New Member

Hey,everyone
Why can't I find these key in my windows 2003 system?

ReplyQuote
Posted : 21/03/2006 1:58 pm
gmarshall139
(@gmarshall139)
Active Member

Perhaps they've changed, I don't have a 2003 system to check it on. An easy way to find it is to enter a very unique search term in your start menu search box. Then open regedit, and search for that term within regedit. Should take you right to it.

ReplyQuote
Posted : 21/03/2006 7:21 pm
keydet89
(@keydet89)
Community Legend

I don't have the key in my Win2K3 VM session, either…but then, I haven't done any searches on that system.

Okay, I did a search and the ACRMru key appeared.

So…try performing a search. If that doesn't add the subkey, then check the permissions on the key against your account.

Harlan

ReplyQuote
Posted : 21/03/2006 8:18 pm
packys
(@packys)
Junior Member

Hello All,

I came across this today, and just had to share.

A new tool called Open in Regedit
http//www.petri.co.il/open_in_regedit_in_ie.htm

Highlight the full path of a registry key, right click, select the tool from the drop-down, and it automatically opens. Fantastic for registry research!

Regards,

Christine
www.e-evidence.info

ReplyQuote
Posted : 01/04/2006 12:50 am
keydet89
(@keydet89)
Community Legend

packsys,

I'm not sure I follow…how is this new tool "fantastic for Registry research"? Seriously…I don't follow.

Harlan

ReplyQuote
Posted : 01/04/2006 4:44 am
christop007
(@christop007)
New Member

hi guys

can i just ask does this key

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars

clear itself each time the person logs off or do they have to manually delete the item for it to disapear.

christop007

ReplyQuote
Posted : 02/04/2006 1:19 am
keydet89
(@keydet89)
Community Legend

christop,

Try it, and let us know.

Export the contents of the key, the log off. Log back in again, and then export the contents of the key again. Are the two files the same?

Harlan

ReplyQuote
Posted : 02/04/2006 2:55 am
packys
(@packys)
Junior Member

Harlan,

In response to your question, I would have to say that any tool that is designed to save me time in my research is worth having.

When I come across references to the values in particular registry keys, these values appearing at the end of a rather long path, rather than open the registry viewer, and expand each folder until I find the value that I am seeking, I would much rather highlight, right-click, and be immediately taken down the full path to the value.

Christine
www.e-evidence.info

ReplyQuote
Posted : 03/04/2006 9:48 pm
Share: