Tag: userassist

Anti-Forensics, Privacy

Disable UserAssist History – Anti-Forensics

To stop Windows (Vista, 7, 8) from tracking the programs you use; > Create a new file and name for ex. disable_userassist.reg > Copy+paste the following lines into it: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] "Start_TrackProgs"=dword:00000000Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] "Start_TrackProgs"=dword:00000000 > Save the file and > Double click it, to import values into …

Anti-Forensics, Privacy

Delete UserAssist History – Anti-forensics

Windows system maintain a set of keys in the registry database to keep track of programs that executed. The number of executions and last execution date and time are available in these keys. UserAssist is a method used to populate a user’s start menu with frequently used applications. The information within the binary UserAssist values …

Anti-Forensics

Anti-Forensics – Delete UserAssist History

Windows Explorer maintains a list of frequently programs executed and shortcuts opened on a Windows machine in the UserAssist registry entries. This is achieved by maintaining a count of application use and last execution date and time in each users NTUSER.DAT registry file. UserAssist registry key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist Under UserAssist key there are two subkeys named, …