Loads information such as "a list of programs recently executed, the last run time, and the execution count" stored in the registry. You can check the name and list of recently executed applications with the loaded data and use the time and number of recently executed applications for analysis.
- Path to the registry file. If you provided the
zippathoption, input the file path in the ZIP file.
- Path to the ZIP file.
After running the
reg-user-assists command, the output fields are as follows:
|key||String||Executable file path|
|exec_count||Integer||Number of times of execution|
|last_execution||Date||Last run time|
|last_written||Date||Last written time|
Retrieve by providing the file path.
Retrieve when the
zippathoption is provided.
reg-user-assists zippath=/opt/logpresso/testdata/registry.zip registry/test/NTUSER.DAT