DFIRHub

Windows registry artifactStardock Fences

Displays a list of links the user had on their desktop at the time of installation

  • Third Party Applications
  • 4 keys
  • NTUSER

Registry keys

4 keys that RECmd reads for this artifact

  • NTUSERrecursive
    Software\Stardock\Fences\InitialSnapshot

    Displays a list of links the user had on their desktop at the time of installation

  • NTUSERrecursive
    Software\Stardock\Fences\Icons

    Displays a list of icons on the user's desktop

  • NTUSERResolutionLastrecursive
    Software\Stardock\Fences\Settings

    Displays a list of connected monitors to the user's computer

  • NTUSERPrimaryMonitorLastrecursive
    Software\Stardock\Fences\Settings

    Displays the user's primary monitor

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)