DFIRHub

Windows registry artifactInternet Explorer

Internet Explorer Registry artifacts

  • Web Browsers
  • 7 keys
  • NTUSER

Registry keys

7 keys that RECmd reads for this artifact

  • NTUSER
    Software\Microsoft\Internet Explorer\Main

    Internet Explorer Registry artifacts

  • NTUSERDownload Directory
    Software\Microsoft\Internet Explorer

    Internet Explorer Registry artifacts

  • NTUSER
    Software\Microsoft\Internet Explorer\NewWindows

    Internet Explorer Registry artifacts

  • NTUSER
    Software\Microsoft\Internet Explorer\Suggested Sites\*

    Internet Explorer Registry artifacts

  • NTUSER
    Software\Microsoft\Internet Explorer\ProtocolExecute\*

    Internet Explorer Registry artifacts

  • NTUSERrecursive
    Software\Microsoft\Internet Explorer\LowRegistry\IEShims

    Internet Explorer Registry artifacts

  • NTUSERrecursive
    Software\Microsoft\Internet Explorer\Main\WindowsSearch

    Internet Explorer Registry artifacts

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)