User Assist

General (Technical, Procedural, Software, Hardware etc.)

Last Post by randomaccess 6 years ago

3 Posts

3 Users

0 Reactions

551 Views

RSS

ClarkK

(@clarkk)

Active Member

Joined: 6 years ago

Posts: 11

Topic starter 19/04/2019 1:59 pm

Can someone provide a short, brief description of what User Assist is? From what I understand, it is a set of registry keys that track program execution. Would like to hear from forensic folks rather than generic forums.

Quote

jaclaz

(@jaclaz)

Illustrious Member

Joined: 17 years ago

Posts: 5133

19/04/2019 3:23 pm

https://blog.didierstevens.com/programs/userassist/

Windows Explorer displays frequently used programs on the left side of the standard XP Start menu.
The data about frequently used programs is kept in the registry under this key
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist

Besides the above program, also

https://www.nirsoft.net/utils/userassist_view.html

Some details on the format of the keys used
https://windowsexplored.com/2012/02/06/a-quick-glance-at-the-userassist-key-in-windows/

jaclaz

ReplyQuote