UserAssist
Definition
A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.
- Location
- Windows Registry, NTUSER.DAT
- Encoding
- ROT13-obfuscated key names
- Records
- GUI program launches per user
- Fields captured
- Run count, last-execution timestamp
Common questions
Why is UserAssist data ROT13-encoded instead of encrypted?+
ROT13 is a trivial letter substitution, not real encryption, so it offers no real security. It exists mainly as a legacy obfuscation layer, and forensic tools decode it instantly during registry parsing.
Does UserAssist track command-line or script execution?+
No, it only logs programs launched through the Windows Explorer shell (double-clicks, Start menu, shortcuts), so console commands or scripts run from a terminal do not appear in this key.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- EVTX
- The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer...
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Prefetch
- A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...