Difference between pages "MakerNote" and "List of Windows MRU Locations"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m (New page: MakerNote is an EXIFv2 tag which can contain additional information about a digital photograph. On many point-and-shoot cameras, the serial number is stored here, inthe MakerNote (tag 0x9...)
 
 
Line 1: Line 1:
−
MakerNote is an EXIFv2 tag which can contain additional information about a digital photograph.
+
==Common==
 +
'''Regedit - Last accessed key'''
 +
:Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
 +
'''Regedit - Favorites'''
 +
:Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites
 +
'''MSPaint - Recent Files'''
 +
:Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
 +
'''Wordpad - Recent Files '''
 +
:Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
 +
'''Common Dialog - Open'''
 +
:Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
 +
'''Common Dialog - Save As '''
 +
:Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
 +
'''WMP8 XP - Recent Files'''
 +
:Software\Microsoft\MediaPlayer\Player\RecentFileList
 +
'''WMP 8 XP - Recent URLs '''
 +
:Software\Microsoft\MediaPlayer\Player\RecentURLList
 +
'''OE6 Stationery list 1 - New Mail'''
 +
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)
 +
'''OE 6 Stationery list 2 - New Mail'''
 +
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
  
−
On many point-and-shoot cameras, the serial number is stored here, inthe MakerNote (tag 0x927c), rather than in the standard Exif information.
+
==Windows 2000/XP==
 +
'''XP Search Files'''
 +
:Software\Microsoft\Search Assistant\ACMru\5603
 +
'''Internet Search Assistant '''
 +
:Software\Microsoft\Search Assistant\ACMru\5001
 +
'''Printers, Computers and People'''
 +
:Software\Microsoft\Search Assistant\ACMru\5647
 +
'''XP Start Menu - Recent'''
 +
:Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
 +
'''Remote Desktop - Connect'''
 +
:Software\Microsoft\Terminal Server Client\Default [MRUnumber]
 +
'''Run dialog box'''
 +
:Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  
−
=References=
+
==Windows ME, 98, and 95==
−
* [http://www.exiv2.org/makernote.html Makernote Formats and Specifications]
+
'''Doc Find Spec MRU'''
−
* [http://www.exiv2.org/tags-canon.html Canon MakerNote Tags]
+
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
 +
'''Find Computer'''
 +
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU
 +
'''Printer Ports'''
 +
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU
 +
'''Run'''
 +
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
 +
'''Window Size/Position'''
 +
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
 +
 
 +
==Microsoft Office 2000==
 +
'''Winword - Open'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU
 +
'''Winword - Save As'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU
 +
'''Winword - Recent Files'''
 +
:Software\Microsoft\Office\9.0\Word\Data
 +
'''Excel - Open'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU
 +
'''Excel - Save As'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU
 +
'''Excel  - Recent Files'''
 +
:Software\Microsoft\Office\9.0\Excel\Recent Files
 +
'''Frontpage - Open'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU
 +
'''Frontpage - Save As'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU
 +
'''Frontpage - Recent lists'''
 +
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
 +
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
 +
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
 +
:Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
 +
:Software\Microsoft\FrontPage\Editor\Recently Used URLs
 +
'''PowerPoint - Open'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU
 +
'''PowerPoint - Save As'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU
 +
'''PowerPoint - Recent Files'''
 +
:Software\Microsoft\Office\9.0\PowerPoint\Recent File List
 +
'''Access - Open'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU
 +
'''Access - Filename MRU'''
 +
:Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
 +
:Software\Microsoft\Office\9.0\Access\Settings
 +
 
 +
==Internet Explorer==
 +
'''Recently Entered Addresses'''
 +
:USERNAME\software\microsoft\internet explorer\typedurls
 +
'''Last Directory Saved To'''
 +
:USERNAME\software\microsoft\internet explorer
 +
 
 +
==Adobe==
 +
'''Media Browser'''
 +
:HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU
 +
'''Acrobat 5.0 Full'''
 +
:HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles
 +
'''Acrobat Reader 5.0'''
 +
:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles
 +
'''Acrobat 8.0 Standard'''
 +
:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles [[User:Pmow|Pmow]] 16:14, 23 July 2008 (UTC)
 +
 
 +
==Windows Explorer==
 +
'''List of Recent Programs Opened'''
 +
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
 +
'''Save Locations by Filetype'''
 +
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
 +
'''Most Recent Application's Use of DirectX'''
 +
:software\microsoft\direct3d\mostrecentapplication
 +
'''List of Recent Files Opened, by Filetype'''
 +
:USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs
 +
 
 +
==Kazaa==
 +
'''Recent Search List'''
 +
:USERNAME\software\kazaa\search
 +
 
 +
==Registry Editor==
 +
'''Last Key Accessed'''
 +
:USERNAME\software\microsoft\windows\currentversion\applets\regedit
 +
==Sources==
 +
 
 +
[http://www.daniweb.com/tutorials/tutorial66079.html Registry MRU Locations]
 +
 
 +
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]

Revision as of 11:14, 23 July 2008

Contents

Common

Regedit - Last accessed key

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Regedit - Favorites

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

MSPaint - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Wordpad - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Common Dialog - Open

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Common Dialog - Save As

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

WMP8 XP - Recent Files

Software\Microsoft\MediaPlayer\Player\RecentFileList

WMP 8 XP - Recent URLs

Software\Microsoft\MediaPlayer\Player\RecentURLList

OE6 Stationery list 1 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)

OE 6 Stationery list 2 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)

Windows 2000/XP

XP Search Files

Software\Microsoft\Search Assistant\ACMru\5603

Internet Search Assistant

Software\Microsoft\Search Assistant\ACMru\5001

Printers, Computers and People

Software\Microsoft\Search Assistant\ACMru\5647

XP Start Menu - Recent

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Remote Desktop - Connect

Software\Microsoft\Terminal Server Client\Default [MRUnumber]

Run dialog box

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows ME, 98, and 95

Doc Find Spec MRU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Find Computer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU

Printer Ports

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU

Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Window Size/Position

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Microsoft Office 2000

Winword - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU

Winword - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU

Winword - Recent Files

Software\Microsoft\Office\9.0\Word\Data

Excel - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU

Excel - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU

Excel - Recent Files

Software\Microsoft\Office\9.0\Excel\Recent Files

Frontpage - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU

Frontpage - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU

Frontpage - Recent lists

Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
Software\Microsoft\FrontPage\Editor\Recently Used URLs

PowerPoint - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU

PowerPoint - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU

PowerPoint - Recent Files

Software\Microsoft\Office\9.0\PowerPoint\Recent File List

Access - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU

Access - Filename MRU

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
Software\Microsoft\Office\9.0\Access\Settings

Internet Explorer

Recently Entered Addresses

USERNAME\software\microsoft\internet explorer\typedurls

Last Directory Saved To

USERNAME\software\microsoft\internet explorer

Adobe

Media Browser

HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU

Acrobat 5.0 Full

HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles

Acrobat Reader 5.0

HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles

Acrobat 8.0 Standard

HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles Pmow 16:14, 23 July 2008 (UTC)

Windows Explorer

List of Recent Programs Opened

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Save Locations by Filetype

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Most Recent Application's Use of DirectX

software\microsoft\direct3d\mostrecentapplication

List of Recent Files Opened, by Filetype

USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs

Kazaa

Recent Search List

USERNAME\software\kazaa\search

Registry Editor

Last Key Accessed

USERNAME\software\microsoft\windows\currentversion\applets\regedit

Sources

Registry MRU Locations

How to Clear the Windows Explorer MRU Lists

Retrieved from "http://www.forensicswiki.org/w/index.php?title=MakerNote&oldid=8312"
Personal tools
Namespaces

Variants
Actions
Navigation:
About forensicswiki.org:
Toolbox