DFIRHub

Windows registry artifactFeatureUsage

Displays the number of times the user has received a notification for an application

  • User Activity
  • 11 keys
  • NTUSER

Registry keys

11 keys that RECmd reads for this artifact

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated

    Displays the number of times the user has received a notification for an application

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch

    Displays the number of times a pinned application was launched from the taskbar

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched

    Displays the number of times an application switched focus (i.e. minimized, maximized, etc)

  • NTUSERrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView

    Displays the number of times an application was right-clicked

  • NTUSERStartButtonrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Start button was clicked

  • NTUSERClockButtonrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Clock button was clicked

  • NTUSERMultitaskingButtonrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Multitasking button was clicked

  • NTUSERNotificationCenterButtonrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Notification Center button was clicked

  • NTUSERSearchButtonrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Search button was clicked

  • NTUSERSearchBoxrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Search box was clicked

  • NTUSERShowDesktopButtonrecursive
    Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked

    Displays the number of times the Show Desktop button was clicked

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)