I first learned about the UserAssist registry key from a PDF article on Computer Forensics (link).
What is the UserAssist registry key?
UserAssist key contains information about the exe files and links that you open frequently.This key gives you information about all the applications, webpages, searches, and some more info that where executed in your machine. It’s like a history but it doesn’t blank.the Start menu has a “UserAssist” area that holds shortcuts to applications most frequently used. This area is automatically populated from the UserAssist Key.The UserAssist registry key resides in the NTUSER.DAT file on disk at:
SoftwareMicrosoftWindows CurrentVersionExplorerUserAssist
or in the Live registry hive:
HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
– Steinbach www.techarena.in (post entry)
This utility decrypt [rot13] and displays the list of all UserAssist entries stored under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist key in the Registry. The UserAssist key contains information about the exe files and links that you open frequently. you can save the list of UserAssist entries into text/html/xml/csv file, as well as you can delete unwanted items.
– Nir Sofer www.nirsoft.net
What can I use to view the entries?
UserAssistView from Nirsoft.net
userassist from Didier Stevens
