![]() ![]() With the information provided from the RunMRU key, an examiner can gain better understanding fo the user they are investigating and the application that is being used.In this above figure, you can see the user has opened cmd, Notepad, MSPaint etc. The location of this key is HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Explorer\RunMRU and it contains The Registry maintains these lists of items in case the user returns to them in the future.It is similar to how the history and cookies act to a web browser.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |