To view or close recently used apps on your LG Stylo 2 V, view this info. Similar to the AppSwitched key, this key functions much like the UserAssist and RecentApps registry keys and can be used to find evidence of GUI application execution; however, it instead shows the number of times the application was right-clicked as opposed to just launched.
I was roaming around some Win10 images and noticed I had the RecentApps registry key to go through. I don’t see it that often and thought I should go and take a look at when Microsoft added it, and took it away.
Thankfully, past me had the smarts to create a bunch of Windows 10 VMs! Where did I find the ISOs you ask? How to write a mustclick headline. I can’t remember. Microsoft hosted them somewhere for a bit, maybe they still do?
Anyways, here’s a table that I put together of Win10 systems that have the RecentApps key available in a base install. I haven’t tested what happens when you run updates, but I do know that it was not in my 1709 install, but I’ve seen it populated on at least one system when 1709 was active. Maybe it was updating the key if it existed?
*I’m putting a star next to 1709 because others have seen RecentApps on this version, so maybe it’s a configuration setting? From Vico’s talk, I’m reading that 1709 was either the last version to have it, or the first version to not have it. On my Windows SIFT Workstation, which was updated from 1709 to 1903 on 27 August 2019, I can see items accessed right until the update. So my working theory is that 1709 would populate the key if it existed, but that hasn’t been tested.
At the very least, we no longer have the key. And we should only really see it for sure in 1607 and 1703, and maybe 1709.
I also don’t really know why Microsoft had it in there to begin with, and if Microsoft previously had use for the data, they probably still do but have moved it into a different location. My guess is they’ve moved it here, but that’s research for another day.
Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.
Become a DeveloperRecent Apps Key
This scripts reads recently-used application information from the following Registry path:
HKCUSoftwareMicrosoftWindowsCurrentVersionSearchRecentApps
This information is linked to the operation of the Windows search function. It can be useful when trying to ascertain the applications and documents (recent items) accessed by the user.
Each application that has no recent items will be represented by a single row in the output spreadsheet.
For applications that do have recent items, there will be one row per item, and the application-data will be repeated.
Download Now
EnCase Forensic 8.08
To begin your download, please provide the following information to generate your trial license. Your 0-day free trial license will be delivered via email.
Success!
Recent Apps For Iphone
| License: | Download Now |
| Installer: | Download Now |
There seems to have been an error. Please contact us for more information.