Windows registry artifactVisualStudio MRUItems

User Activity
1 key
NTUSER

Registry keys

1 key that RECmd reads for this artifact

NTUSER
Software\Microsoft\VisualStudio\*\MRUItems\*\Items

Parse it

Run the DFIRBatch.reb batch file on collected hives

RECmd

RECmd.exe -d "D:\Evidence" --bn BatchExamples\DFIRBatch.reb --csv "D:\Parsed"

KAPE module

kape.exe --msource D:\Evidence --mdest D:\Parsed --module RECmd_DFIRBatch

Collect the hives

KAPE targets that copy these hives

RegistryHivesUser

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)