Exploring program execution

Program execution artifacts indicate programs or applications that were run on the system. The user could cause the execution, or an autostart/run event managed by the system. Some categories overlap with the file knowledge category we discussed earlier in the chapter. I am not going to re-examine those specific artifacts in this section. Just be aware that the artifacts from recent apps, JumpLists, an MRU, and prefetch files will also contain information about program/application activity.

Determining UserAssist

UserAssist is a registry key in the user’s NTUSER.DAT file and can be found at the following path:

NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist

The key tracks the GUI-based applications that were launched in the system. The system encodes the data in the key with ROT 13 encoding. RegRipper will decode the data automatically. The following represents the output you will see from RegRipper:

...