Skip to content

Conversation

reece394
Copy link
Contributor

Description

Continuing on from #99. Tested more User.dat registry keys and confirmed Network and Map Network Drive MRU are written and stored.

Additionally tested the Windows Store version of WordPad from the days of Project Centennial. This was released for Windows Insiders but never officially rolled out however it is still floating about on the Windows Store servers if you know where to look. Store page is still active here and still works for Windows 11. Covering it in case any creative sysadmins install it for familiarity.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have generated a unique GUID for my Batch file(s)
  • I have tested and validated the new Batch file(s) against test data and achieved the desired output
  • I have placed the Batch file(s) within the .\RECmd\BatchExamples directory
  • I have set or updated the version of my Batch file(s)
  • I have made an attempt to document the artifacts within the Batch file(s)
  • I have consulted the Guide/Template to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!

@AndrewRathbun AndrewRathbun merged commit 718ff16 into EricZimmerman:master Jul 18, 2025
1 check passed
@AndrewRathbun AndrewRathbun self-assigned this Jul 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants