Join Us!

Notifications
Clear all

User Assist  

  RSS
ClarkK
(@clarkk)
New Member

Can someone provide a short, brief description of what User Assist is? From what I understand, it is a set of registry keys that track program execution. Would like to hear from forensic folks rather than generic forums.

Quote
Posted : 19/04/2019 2:59 pm
jaclaz
(@jaclaz)
Community Legend

https://blog.didierstevens.com/programs/userassist/

Windows Explorer displays frequently used programs on the left side of the standard XP Start menu.
The data about frequently used programs is kept in the registry under this key
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist

Besides the above program, also

https://www.nirsoft.net/utils/userassist_view.html

Some details on the format of the keys used
https://windowsexplored.com/2012/02/06/a-quick-glance-at-the-userassist-key-in-windows/

jaclaz

ReplyQuote
Posted : 19/04/2019 4:23 pm
randomaccess
(@randomaccess)
Active Member

Good way to track GUI program executions

ReplyQuote
Posted : 21/04/2019 6:33 am
Share: