DFIRHub

Windows registry artifactRegistry Editor Usage

Displays the last registry key accessed by the user in RegEdit

  • User Activity
  • 2 keys
  • NTUSER

Registry keys

2 keys that RECmd reads for this artifact

  • NTUSERLastKey
    Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

    Displays the last registry key accessed by the user in RegEdit

  • NTUSER
    Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

    Displays favourite registry keys saved by the user in RegEdit

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)