DFIRHub

Windows registry artifactWebcam

Displays the timestamp of when a webcam started being used with a given application

  • Devices
  • 2 keys
  • SOFTWARE

Registry keys

2 keys that RECmd reads for this artifact

  • SOFTWARELastUsedTimeStartrecursive
    Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\*\*

    Displays the timestamp of when a webcam started being used with a given application

  • SOFTWARELastUsedTimeStoprecursive
    Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\*\*

    Displays the timestamp of when a webcam stopped being used with a given application

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)