DFIRHub

AceText

AceText

  • Apps
  • 1 path
  • *.atc
  • Per-user data
  • Version 1
  • Andrew Rathbun

Paths on disk

1 path

Paths use Windows environment variable syntax

Notes

AceText is made by the same people who make Edit Pad Pro, PowerGREP, etc. It's a cool program that serves as a Clipboard extension tool.

From a forensic perspective, the entirety of a user's clipboard history is available for our perusal!

Once you have the .atc file, you can open with any text editor and see the entire history of a user's clipboard contents.

The copied text will be found between the <text> and </text> parameters.

If content is copied from a webpage, copied text will be the same as above but there will also be a <url> and </url> parameter which will display the URL from which the contents were copied from.

In addition to the above, the kind= parameter will provide clues as to where the contents were copied from.