While digging into a Windows 10 NTUSER.DAT hive recently, I came across a registry key/subkey hierarchy that was really intriguing. The top level key, called RecentApps, contained references to several applications and files that had been accessed on the system. In addition to the application and file name, I found that the path to the application, a launch count, the full path to the file, and the last time the file was accessed was available from the RecentApps key hierarchy.
The RecentApps key is located in the user’s NTUSER.DAT hive at Software\Microsoft\Windows\Current Version\Search\RecentApps. Its general hierarchy looks something like the image below. Beneath the RecentApps key is a series of subkeys named by GUIDs. Each GUID subkey directly under RecentApps corresponds to an application. Some of the GUID subkeys have additional subkeys as well, which correspond to particular files accessed by the application.
 |
| RecentApps key hierarchy |
Application GUID Subkeys
As mentioned, the subkeys directly under RecentApps are associated with applications. Each of these GUID subkeys contain values that may be of useful during an examination, such as the full path to the application, a last accessed time, and a launch count. The LastAccessedTime value is in the ever-popular 64-bit FILETIME format. In my experience, both the LastAccessedTime and LaunchCount values have been consistent with the last execution and run count data available in the UserAssist key.
 |
| RecentApps File Subkey |
File GUID Subkeys
The last accessed time, when present, is a FILETIME value and appears to be consistent with the last accessed time available from jump lists in the file system. Unfortunately, this value does not appear to be populated in many cases. Windows 10 Professional version 1703 build 15063.483 has been observed with the LastAccessedTime value populated, but in all other tested versions of Windows 10 – both before and after the release of 15063.483 – this value appears to be set to zero. Fortunately, an access time for the file referenced by the file GUID subkey can be determined using the LastWrite time of the file GUID subkey itself. Importantly, the LastWrite time does not appear to be updated on subsequent access to the file, so the LastWrite time should not be concluded as the last time the file was accessed without further corroborating evidence from other artifacts.
 |
| RecentApps\RecentItems Subkeys |
The number of file GUID subkeys under each application GUID key appears to be limited to 10. Interestingly, the cycling of these subkeys does not appear to be on a first-in-first-out basis (as with many other artifacts in Windows). Instead, it appears that when an eleventh subkey is added to an application GUID key, the file GUID subkeys are arranged alphabetically by name. After being arranged alphabetically, the last one in the list is removed. Since the alphabetization is by GUID, it is inherently random which 10 files that were accessed by an application will be included in the list of file GUID subkeys . The method of cycling utilized by the file GUID subkeys means that an examiner cannot conclude that the files referenced by these subkeys are the 10 files most recently accessed by a particular application.
Data points such as the RecentApps key hierarchy in Windows 10 help to provide corroborating information to increase an examiner’s overall confidence in his or her findings. If any type of anti-forensic measures were taken (system or user initiated), locations such as the RecentApps key may also provide information that was deleted from other and more well known areas of the system.