Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Windows Search Application Data Parser

This scripts reads recently-used application information from the following Registry path:

HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps

This information is linked to the operation of the Windows search function. It can be useful when trying to ascertain the applications and documents (recent items) accessed by the user. 

Each application that has no recent items will be represented by a single row in the output spreadsheet.

For applications that do have recent items, there will be one row per item, and the application-data will be repeated.

Download Now



Version: 1.0.0
Tested with:
EnCase Forensic 8.08
Developer: Simon Key
Category: Artifact

84 DOWNLOADS

YOU MAY ALSO LIKE

Artifact

WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key
7449 Downloads
App
Artifact

Cortana Search Decoder

Decodes the search terms stored in IndexedDB.edb files used by the Microsoft Windows Cortana search function.
By Simon Key
1726 Downloads
App
Artifact

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key
141 Downloads
App
Artifact

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key
98 Downloads
App