This utility decrypt and displays the list of all UserAssist entries stored under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist key in the Registry.

2016年3月10日 · Explore the UserAssist artifact in Windows forensics, tracking app usage to help reconstruct user activity and investigate malicious actions.

2006年8月6日 · The UserAssist utility displays a table of programs executed on a Windows machine, complete with running count and last execution date and time. Windows Explorer maintains this information in the UserAssist registry entries. My program allows you to display and manipulate these entries. I posted my program (source code and binaries) here.

2025年2月25日 · UserAssist is one of the most detailed forensic artifacts for tracking GUI-based application execution, providing valuable insights into what programs were used, how often, and for how long.

Tests were run on some of the more common user activities (and POC actions) to see exactly how UserAssist entries are triggered. The 13 scenarios below illustrate how UserAssist entries look both in the registry and in timelines after a given user action is performed.

2018年5月23日 · During a forensic analysis of a Windows system, it is often critical to understand when and how a particular process has been started. In order to identify this activity, we can extract from the target system a set of artifacts useful to collect evidences of program execution.

2024年11月8日 · The UserAssist key contains information about the exe files and links that you open frequently. you can save the list of UserAssist entries into text/html/xml/csv file, as well as you can delete unwanted items.

UserAssist is your trusty guide to uncovering your application history and user activities. With open-source forensic tools, the process is a breeze. They simplify the journey, letting you access and decode UserAssist data, making digital investigations a walk in the park.

2015年4月15日 · Windows systems maintain a set of keys in the registry database (UserAssist keys) to keep track of programs that executed. The number of executions and last execution date and time are available in these keys.

2024年11月8日 · This utility decrypts and displays the list of all UserAssist entries stored under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist key in the Registry.