Windows registry artifactMountPoints2
Mount Points - NTUSER
- Devices
- 2 keys
NTUSERUser
Registry keys
2 keys that RECmd reads for this artifact
NTUSERrecursiveSoftware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2Mount Points - NTUSER
UserrecursiveSoftware\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2Mount Points - User.dat Windows Store UWP
References
4 links
- sans.org/security-resources/posters/windows-forensic-analysis/170/download(opens in new tab)
- eforensicsmag.com/investigating-usb-drives-using-mount-points-not-drive-letters-by-ali-hadi/(opens in new tab)
- andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/(opens in new tab)
- forensicfocus.com/articles/forensic-analysis-of-the-windows-registry/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)