Added More User.dat Windows Store UWP Artifacts - Network Share and WordPad #100
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Continuing on from #99. Tested more User.dat registry keys and confirmed Network and Map Network Drive MRU are written and stored.
Additionally tested the Windows Store version of WordPad from the days of Project Centennial. This was released for Windows Insiders but never officially rolled out however it is still floating about on the Windows Store servers if you know where to look. Store page is still active here and still works for Windows 11. Covering it in case any creative sysadmins install it for familiarity.
Checklist:
Please replace every instance of
[ ]
with[X]
OR click on the checkboxes after you submit your PRGUID
for my Batch file(s).\RECmd\BatchExamples
directoryThank you for your submission and for contributing to the DFIR community!