Difference between pages "List of Windows MRU Locations" and "Compression"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Deflate/Inflate)
 
Line 1: Line 1:
==Common==
+
{{Expand}}
'''Regedit - Last accessed key'''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
+
'''Regedit - Favorites'''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites
+
'''MSPaint - Recent Files'''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
+
'''Wordpad - Recent Files '''
+
:Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
+
'''Common Dialog - Open'''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
+
'''Common Dialog - Save As '''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
+
'''WMP8 XP - Recent Files'''
+
:Software\Microsoft\MediaPlayer\Player\RecentFileList
+
'''WMP 8 XP - Recent URLs '''
+
:Software\Microsoft\MediaPlayer\Player\RecentURLList
+
'''OE6 Stationery list 1 - New Mail'''
+
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)
+
'''OE 6 Stationery list 2 - New Mail'''
+
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
+
  
==Windows 2000/XP==
+
== LZ-based ==
'''XP Search Files'''
+
:Software\Microsoft\Search Assistant\ACMru\5603
+
'''Internet Search Assistant '''
+
:Software\Microsoft\Search Assistant\ACMru\5001
+
'''Printers, Computers and People'''
+
:Software\Microsoft\Search Assistant\ACMru\5647
+
'''XP Start Menu - Recent'''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
+
'''Remote Desktop - Connect'''
+
:Software\Microsoft\Terminal Server Client\Default [MRUnumber]
+
'''Run dialog box'''
+
:Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
+
  
==Windows ME, 98, and 95==
+
=== Deflate/Inflate ===
'''Doc Find Spec MRU'''
+
Used in:
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
+
* [[Encase image file format|Expert Witness (Compression) Format (EWF)]]
'''Find Computer'''
+
* [[Gzip|gzip]]
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU
+
'''Printer Ports'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU
+
'''Run'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
+
'''Window Size/Position'''
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
+
  
==Microsoft Office 2000==
+
=== LZNT1 ===
'''Winword - Open'''
+
Used in:
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU
+
* [[NTFS]]
'''Winword - Save As'''
+
* [[Windows SuperFetch Format]]
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU
+
'''Winword - Recent Files'''
+
:Software\Microsoft\Office\9.0\Word\Data
+
'''Excel - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU
+
'''Excel - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU
+
'''Excel  - Recent Files'''
+
:Software\Microsoft\Office\9.0\Excel\Recent Files
+
'''Frontpage - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU
+
'''Frontpage - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU
+
'''Frontpage - Recent lists'''
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
+
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
+
:Software\Microsoft\FrontPage\Editor\Recently Used URLs
+
'''PowerPoint - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU
+
'''PowerPoint - Save As'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU
+
'''PowerPoint - Recent Files'''
+
:Software\Microsoft\Office\9.0\PowerPoint\Recent File List
+
'''Access - Open'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU
+
'''Access - Filename MRU'''
+
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
+
:Software\Microsoft\Office\9.0\Access\Settings
+
  
==Internet Explorer==
+
=== LZXPRESS ===
'''Recently Entered Addresses'''
+
Used in:
:USERNAME\software\microsoft\internet explorer\typedurls
+
* [[Extensible Storage Engine (ESE) Database File (EDB) format]]
'''Last Directory Saved To'''
+
:USERNAME\software\microsoft\internet explorer
+
  
==Adobe==
+
=== LZXPRESS Huffman ===
'''Media Browser'''
+
Used in:
:HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU
+
* [[Windows SuperFetch Format]]
'''Acrobat 5.0 Full'''
+
:HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles
+
'''Acrobat Reader 5.0'''
+
:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles
+
'''Acrobat 8.0 Standard'''
+
:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles [[User:Pmow|Pmow]] 16:14, 23 July 2008 (UTC)
+
  
==Windows Explorer==
+
== External Links ==
'''List of Recent Programs Opened'''
+
* [http://en.wikipedia.org/wiki/Lempel-Ziv Wikipedia: Lempel-Ziv]
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
+
* [http://www.coderforlife.com/microsoft-compression-formats/ Microsoft Compression Formats]
'''Save Locations by Filetype'''
+
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
+
'''Most Recent Application's Use of DirectX'''
+
:software\microsoft\direct3d\mostrecentapplication
+
'''List of Recent Files Opened, by Filetype'''
+
:USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs
+
  
==Kazaa==
+
=== Deflate/Inflate ===
'''Recent Search List'''
+
* [http://en.wikipedia.org/wiki/DEFLATE Wikipedia: DEFLATE]
:USERNAME\software\kazaa\search
+
* [https://tools.ietf.org/html/rfc1950 RFC1950 - ZLIB Compressed Data Format Specification], by [[IETF]]
 +
* [https://tools.ietf.org/html/rfc1951 RFC1951 - DEFLATE Compressed Data Format Specification], by [[IETF]]
  
==Registry Editor==
+
=== LZ1 ===
'''Last Key Accessed'''
+
* [http://andyh.org/LZ1.html LZ1]
:USERNAME\software\microsoft\windows\currentversion\applets\regedit
+
==Sources==
+
 
+
[http://www.daniweb.com/tutorials/tutorial66079.html Registry MRU Locations]
+
 
+
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]
+

Revision as of 08:58, 21 June 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

LZ-based

Deflate/Inflate

Used in:

LZNT1

Used in:

LZXPRESS

Used in:

LZXPRESS Huffman

Used in:

External Links

Deflate/Inflate

LZ1