Hi.
In this video you will learn how to analyze user key.
What is Userassist?
Windows Systems have a database that stores important operating system and application configurations.
This database is called the Windows Registry and it consists of keys and values similar to folders and
files in a file system.
User access is a key located in a section of the registry that records the execution history of programs
frequently run by a user.
Values such as file name, last execution time and execution count can be found in the user key.
Forensic value of user artifacts.
User assist artifacts are a valuable source of forensic evidence in digital investigations.
They can help investigators reconstruct a user's activities and identify suspicious or malicious behavior.
User assist artifacts can provide information about program execution, frequency, duration and lost
runtime.
However, they are not foolproof and should be corroborated with other sources of evidence.
Location of user structures.
The user assist source file is located at C users.
Your username and the user dot dot artifacts can be found within the user dot archives at the following
location.
Current user Software.
Microsoft Windows Currentversion Explorer User Assist.
Here you can see the key user assist and the sub keys in the regedit.
Now let's reinforce what we learned with tools.
Before starting our analysis, we need to export the user file.
We can use the FTK imager tool.
You can install this tool with a setup file which we provided you in the resources dot seven zip file.
FTK Imager is a digital forensic software tool commonly used by law enforcement and computer forensic
experts to create forensic images of digital media.
These images allow investigators to capture a copy of the contents of a storage device, including deleted
and hidden data, and safely analyze it for evidence gathering in legal proceedings, click file.
It Evidence item Logical drive.
Next see and finish.
Expand the trees until you see root folder.
Then click root.
User's image, which in this case your username.
Scroll to the bottom.
Right click on Ntuser.dat file and export it to a distinct directory.
Okay.
We needed to use the imager tool to export the end user file because this file is always used by a process,
so we are not allowed to access it.
I mean, we cannot directly copy and paste it here.
Now we will use the Register Explorer to extract user assist artifact from user file.
The good thing about this tool is it allows us to line monitor system files only if we run it as administrator.
But this is not a feature we use in this video.
Double click the Registry Explorer application.
You can easily drag and drop the user file.
Click no and yes in order.
Here.
There are two options.
First one is to go to the registry location of user assist by moving to route software.
Microsoft and blah blah.
Or you can directly click available bookmarks, scroll to the bottom and expand the user assist.
User assist is our key.
There are nine sub keys for this key.
As you see over here.
We will look for the sub key which has more than one count values.
I will keep expanding the sub keys.
You just want to use the full sub key, click on count.
Let's make this full screen.
We can sort the wrong contour in ascending order.
We can analyze valuable information about related programs.
Available data columns are run, counter focus, count focus, time and last execution time.
Focus count is a number indicating how frequently an application is brought to the foreground.
This value can be used to determine how often an application is being used or which applications are
more popular.
Focus Time.
Focus.
Time is a time interval indicating how long an application has been used in foreground.
This value can be used to determine how intensively an application is being used or which applications
are being kept open for longer periods of time.
These two values are important for understanding how frequently and how long an application is being
used.
They provide significant insights into which applications the user is focusing on and can be used by
digital forensic investigators in analyzing user behavior.
Now, let's talk about the program over here.
This program names data represents the sum of these all programs.
Let's examine a program telegram.
The run counter is 27.
Focus count is 99 and focus time is 51 minute and the last execution time is 15th of March.
Last but not least, I must mention when these records are refreshed, user access records are not reset
each time you shut down your computer.
However, the frequency of updates to the records depends on how often the user uses their applications.
For example, if an application is not used for a long time, the user s record may not be updated.
This video is over.
See you in the next videos.