Windows registry artifactRunMRU
Tracks commands from the Run box in the Start menu, lower MRU # (Value Data3) = more recent
- Program Execution
- 1 key
NTUSER
Registry keys
1 key that RECmd reads for this artifact
NTUSERSoftware\Microsoft\Windows\CurrentVersion\Explorer\RunMRUTracks commands from the Run box in the Start menu, lower MRU # (Value Data3) = more recent
References
5 links
- github.comRunMRU plugin(opens in new tab)
- digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/(opens in new tab)
- andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/(opens in new tab)
- silo.tips/download/a-forensic-analysis-of-the-windows-registry(opens in new tab)
- forensafe.com/blogs/runmru.html(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)