25+ years serving the scientific and engineering community Log In Watch Videos Try Origin for Free Buy. Recent Applications: Navigating to this following key will give information for last accessed applications list HKEYCURRENTUSERSOFTWAREMicrosoftCurrentversionSearchRecentApps. In this user has a vast list of applications, one of those was Vmworkstation found.
RecentApps Description GUI Program execution launched on the Win10 system is tracked in the RecentApps key Location Win10: NTUSER.DATSoftwareMicrosoftWindowsCurrent VersionSearchRecentApps Interpretation Each GUID key points to a recent application. AppID = Name of Application LastAccessTime = Last execution time in UTC. I am working on a lock screen app. When the lock screen activity is running,long pressing HOME key or pressing RecentApps key will call out the RecentApps screen and the screen lock will be bypasse.
I was roaming around some Win10 images and noticed I had the RecentApps registry key to go through. I don’t see it that often and thought I should go and take a look at when Microsoft added it, and took it away.
Thankfully, past me had the smarts to create a bunch of Windows 10 VMs! Where did I find the ISOs you ask? I can’t remember. Microsoft hosted them somewhere for a bit, maybe they still do?
Anyways, here’s a table that I put together of Win10 systems that have the RecentApps key available in a base install. I haven’t tested what happens when you run updates, but I do know that it was not in my 1709 install, but I’ve seen it populated on at least one system when 1709 was active. Maybe it was updating the key if it existed?
*I’m putting a star next to 1709 because others have seen RecentApps on this version, so maybe it’s a configuration setting? From Vico’s talk, I’m reading that 1709 was either the last version to have it, or the first version to not have it. On my Windows SIFT Workstation, which was updated from 1709 to 1903 on 27 August 2019, I can see items accessed right until the update. So my working theory is that 1709 would populate the key if it existed, but that hasn’t been tested.
At the very least, we no longer have the key. And we should only really see it for sure in 1607 and 1703, and maybe 1709.
I also don’t really know why Microsoft had it in there to begin with, and if Microsoft previously had use for the data, they probably still do but have moved it into a different location. My guess is they’ve moved it here, but that’s research for another day.
Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.
Become a Developer![RecentApps RecentApps](https://img.xda-cdn.com/Mf8bqFUjbkSm-ufZVqKE9_9duy4=/http:%2F%2Fi.imgur.com%2FC7IwNgr.png)
This scripts reads recently-used application information from the following Registry path:
HKCUSoftwareMicrosoftWindowsCurrentVersionSearchRecentApps
Android Recent Apps Button
This information is linked to the operation of the Windows search function. It can be useful when trying to ascertain the applications and documents (recent items) accessed by the user.
Each application that has no recent items will be represented by a single row in the output spreadsheet.
![Button Button](/uploads/1/2/4/8/124870512/621612853.jpg)
For applications that do have recent items, there will be one row per item, and the application-data will be repeated.
Download Now Tested with:
EnCase Forensic 8.08
EnCase Forensic 8.08
Category: Artifact
18 Downloads in last 6 months
To begin your download, please provide the following information to generate your trial license. Your 0-day free trial license will be delivered via email.
Success!
Recent Apps Downloaded
License: | Download Now |
Installer: | Download Now |
Recent Apps
There seems to have been an error. Please contact us for more information.