Difference between pages "OpenSavePidlMRU" and "File:5-ScrewRemoval.jpg"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(New page)
 
 
Line 1: Line 1:
The [[OpenSaveMRU]] Windows registry key was renamed starting in Windows Vista to OpenSavePidlMRU [http://www.forensicmag.com/articles/2012/04/windows-7-registry-forensics-part-4].
 
  
== Notable Changes from Windows XP ==
 
 
The * sub-key of OpenSavePidlMRU was extended to track the last twenty files opened or saved of any type via the Windows Common Dialog [http://computer-forensics.sans.org/blog/2010/04/02/openrunsavemru-lastvisitedmru].
 
 
Value data is stored as binary (REG_BINARY) and was previously stored as a string value (REG_SZ) in [[OpenSaveMRU]].
 

Latest revision as of 00:09, 8 August 2013