Maxitems = 20 maximum number of items in the menu (not including the "Clear MRU History!" item)įolderfullpath = 0 boolean: display the full path of the folder items? Iconsize = 16 size of the icons in the menu: 16 or 13 (other sizes accepted but not recommended) Trayicon = 0 boolean: stay resident in the tray? defaults for the user modifiable constants Additional INI constants, added in v1.1: (Leave them blank or commented out if the program works fine) The INI file must have the following structure: "%appdata%\Recent Menu\Recent Menu.ini" or "\Recent Menu.ini". The INI file MUST be "%appdata%\Recent Menu.ini", The same parameters can be specified in an INI file. folderfullpath=1 Display the full path in the Folders menu. Default: 20 (The most recent items are always on top of the menus) maxitems=30 Maximum number of items in each menu. Default: 16 (Other values between 16 and 64 accepted but not recommended) Default: 0 (Advantage of tray mode: much more rapid to display the menu) The script accepts the following arguments: Additionally, a menu item is added in each sub-menu to clear the history. If Anvir Task Manager is installed and running, it displays also a sub menu with the recently executed programs. Displays a popup menu with the recently used documents and folders as sub-menus. necessary only if the script cannot find the folders automatically. Added two options in the INI file to specify the "Recent" and the Anvir "Tray" folder locations, to form v1.1, that should be compatible with Vista, Win 7 and XP. The original Vista/7 version v1.0 and the modified version for XP have been merged by r0lZ The original file has been modified by DataLife to adapt it to Windows XP. First release, compatible only with Vista and Win7 The script MUST use the x32 version of AutoHotkey_L, or no icons will be displayed in the menus.
#RECENTAPPS WINDOWS 7 WINDOWS 7#
AutoHotkey script Developed with AHK_L v1.0.48.05.L51 x32 Unicode (W) version, under Windows 7 圆4. So, if you compile the script and it cannot find the right folder(s) (the menus are empty), you just have to edit the INI file. I did it because there is no hardcoded variable pointing to the Recent folder (something like %A_Recent%), and of course, the same problem exists for the Anvir folder. I have also added 2 new parameters in the INI file: the folder location of the "Recent" items, and the folder of the recent apps maintained by Anvir task manager. I haven't enough time to search for the problem right now. But it works fine under my Win7 圆4 when using the 32bit version of AHK_L. Note that it doesn't work well (the icons are missing) if it runs under AHK_L 圆4, or if it is compiled with AHK_L 圆4, even under an 圆4 platform. The script should now run fine under XP (as well as Vista and Win7), although I have tested it only under Win7 圆4. Interpretation Each GUID key points to a recent application.Anyway, I did it. Location Win10: NTUSER.DAT\Software\Microsoft\Windows\Current Version\Search\RecentApps Location C:\Users\\AppData\Local\ConnectedDevices Platform\L.\ActivitiesCache.dbĭescription GUI Program execution launched on the Win10 system is tracked in the RecentApps key The data is recorded in a SQLite database. Windows 7 contains at most 1,024 entries - LastUpdateTime does not exist on Win7 systemsĭescription Win10 records recently used applications and files in a “timeline” accessible via the “WIN+TAB” key.
Windows XP contains at most 96 entries - LastUpdateTime is updated when the files are executed.In addition, based on the interpretation of the time-based data you might be able to determine the last time of execution or activity on the system. You can use this key to identify systems that specific malware was executed on. Interpretation : Any executable run on the Windows system could be found in this key.
Location XP: SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatibility Win7/8/10: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
#RECENTAPPS WINDOWS 7 UPDATE#
Tracks the executables file name, file size, last modified time, and in Windows XP the last update time.Windows Application Compatibility Database is used by Windows to identify possible application compatibility challenges with executables.SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache Learn about using Windows registry data when performing forensic analysis of computer networks.ĭescription Windows Background Activity Moderator (BAM) Location Win10: SYSTEM\CurrentControlSet\Services\bam\UserSettings\ Investigative Notes Provides full path of the executable file that was run on the system and last execution date/time Digging Up the Past: Windows Registry Forensics Revisited
0 kommentar(er)
