Difference between pages "List of Windows MRU Locations" and "Talk:Carver 2.0 Planning Page"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (Added more sources)
 
 
Line 1: Line 1:
==Common==
+
License: have we even discussed a license yet?  Who chose it?  I'm not terribly opposed to a 3-clause BSD, but...? - [[User:RB|RB]] 00:39, 30 October 2008 (UTC)
'''Regedit - Last accessed key'''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
+
'''Regedit - Favorites'''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites
+
'''MSPaint - Recent Files'''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
+
'''Wordpad - Recent Files '''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
+
'''Common Dialog - Open'''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
+
'''Common Dialog - Save As '''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
+
'''WMP8 XP - Recent Files'''
+
:Software\Microsoft\MediaPlayer\Player\RecentFileList
+
'''WMP 8 XP - Recent URLs '''
+
:Software\Microsoft\MediaPlayer\Player\RecentURLList
+
'''OE6 Stationery list 1 - New Mail'''
+
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)
+
'''OE 6 Stationery list 2 - New Mail'''
+
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
+
'''Map Network Drives'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
+
  
==Windows 2000/XP==
+
[[User:Joachim Metz|Joachim]] I prefer the LPGL it's restricts the usage of the code somewhat more. When its integrated in other (closed source) tooling which is published, they must publish that the tool uses this code.
'''''Recently Used Files'''''
+
:C:\Documents and Settings\User\Recent
+
'''XP Search Files'''
+
:Software\Microsoft\Search Assistant\ACMru\5603
+
'''Internet Search Assistant '''
+
:Software\Microsoft\Search Assistant\ACMru\5001
+
'''Printers, Computers and People'''
+
:Software\Microsoft\Search Assistant\ACMru\5647
+
'''XP Start Menu - Recent'''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
+
'''Remote Desktop - Connect'''
+
:Software\Microsoft\Terminal Server Client\Default [MRUnumber]
+
'''Run dialog box'''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
+
  
==Windows ME, 98, and 95==
+
:: LGPL?
'''Doc Find Spec MRU'''
+
:: [[User:.FUF|.FUF]] 19:40, 31 October 2008 (UTC)
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
+
:: [[User:Joachim Metz|Joachim]] GNU Library or "Lesser" General Public License (LGPL) (http://www.opensource.org/licenses/alphabetical)
'''Find Computer'''
+
:::: ''Joachim I prefer the LPGL'' :) [[User:.FUF|.FUF]] 19:51, 31 October 2008 (UTC)
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU
+
:::::: [[User:Joachim Metz|Joachim]] To quote Homer Simpson "Doh!"
'''Printer Ports'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU
+
'''Run'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
+
'''Window Size/Position'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
+
 
+
==Microsoft Office 2000==
+
'''Winword - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU
+
'''Winword - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU
+
'''Winword - Recent Files'''
+
:Software\Microsoft\Office\9.0\Word\Data
+
'''Excel - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU
+
'''Excel - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU
+
'''Excel  - Recent Files'''
+
:Software\Microsoft\Office\9.0\Excel\Recent Files
+
'''Frontpage - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU
+
'''Frontpage - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU
+
'''Frontpage - Recent lists'''
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
+
:Software\Microsoft\FrontPage\Editor\Recently Used URLs
+
'''PowerPoint - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU
+
'''PowerPoint - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU
+
'''PowerPoint - Recent Files'''
+
:Software\Microsoft\Office\9.0\PowerPoint\Recent File List
+
'''Access - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU
+
'''Access - Filename MRU'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
+
:Software\Microsoft\Office\9.0\Access\Settings
+
 
+
==Internet Explorer==
+
'''Recently Entered Addresses'''
+
:USERNAME\software\microsoft\internet explorer\typedurls
+
'''Last Directory Saved To'''
+
:USERNAME\software\microsoft\internet explorer
+
 
+
==Adobe==
+
'''Media Browser'''
+
:HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU
+
'''Acrobat 5.0 Full'''
+
:HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles
+
'''Acrobat Reader 5.0'''
+
:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles
+
'''Acrobat 8.0 Standard'''
+
:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles [[User:Pmow|Pmow]] 16:14, 23 July 2008 (UTC)
+
 
+
==Windows Explorer==
+
'''List of Recent Programs Opened'''
+
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
+
'''Save Locations by Filetype'''
+
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
+
'''Most Recent Application's Use of DirectX'''
+
:software\microsoft\direct3d\mostrecentapplication
+
'''List of Recent Files Opened, by Filetype'''
+
:USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs
+
 
+
==Kazaa==
+
'''Recent Search List'''
+
:USERNAME\software\kazaa\search
+
 
+
==Registry Editor==
+
'''Last Key Accessed'''
+
:USERNAME\software\microsoft\windows\currentversion\applets\regedit
+
==Sources==
+
 
+
[http://www.daniweb.com/tutorials/tutorial66079.html Registry MRU Locations]
+
 
+
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]
+
 
+
[http://209.85.215.104/search?q=cache:ztqvo2Bfk9UJ:www.daniweb.com/forums/thread13426.html+adobe+MRU+location&hl=en&ct=clnk&cd=2&gl=us&client=firefox-a What are MRU files and why are they a security risk?]
+
 
+
[http://www.windowsbbs.com/windows-2000/47519-removing-mru-list-mapped-network-drives.html Removing MRU List from Mapped Network Drives]
+

Revision as of 14:53, 31 October 2008

License: have we even discussed a license yet? Who chose it? I'm not terribly opposed to a 3-clause BSD, but...? - RB 00:39, 30 October 2008 (UTC)

Joachim I prefer the LPGL it's restricts the usage of the code somewhat more. When its integrated in other (closed source) tooling which is published, they must publish that the tool uses this code.

LGPL?
.FUF 19:40, 31 October 2008 (UTC)
Joachim GNU Library or "Lesser" General Public License (LGPL) (http://www.opensource.org/licenses/alphabetical)
Joachim I prefer the LPGL :) .FUF 19:51, 31 October 2008 (UTC)
Joachim To quote Homer Simpson "Doh!"