ACMRU (Win XP)

ACMRU, or AutoComplete Memory Registry Unit, is a key artifact in Windows XP that records the search terms entered by users through the Search Assistant. This functionality is an integral part of the operating system's user experience, allowing for quick retrieval of previous searches. The ACMRU keys within the NTUSER.DAT hive provide a comprehensive record of various search categories, including files, computers, and specific content within files. Each category of search is identified by a unique identifier, making it possible to distinguish between different types of searches performed by the user.

Key Insights:

• Registry Location:

  • NTUSER.DAT\Software\Microsoft\SearchAssistant\ACMru\####

• Categories of Search:

  • Search the Internet: ####=5001

  • All or Part of a Document Name: ####=5603

  • A Word or Phrase in a File: ####=5604

  • Printers, Computers, and People: ####=5647

Deeper Dive

ACMRU Search Categories

• The ACMRU keys offer insights into the specific searches conducted by a user. By analyzing these keys, investigators can discern whether a user was searching for files, phrases within documents, or even other computers on a network. This granularity helps in constructing a detailed profile of user behavior and potentially uncovering evidence of interest in digital forensics cases.

Analyzing The Artifact

• To effectively analyze ACMRU data, follow these steps:

  1. Access the NTUSER.DAT Hive: Use a registry editor or forensic tool to navigate to the ACMRU keys.

  2. Identify the Search Categories: Look at the specific numerical identifiers to understand the type of search (e.g., files, phrases, computers).

  3. Examine the Search Terms: Analyze the stored values to see what the user was searching for. This can reveal interests, intentions, or specific files and information the user was attempting to locate.

  4. Correlate with Other Artifacts: Combine the ACMRU findings with other digital artifacts to build a comprehensive picture of user activity, potentially linking searches to accessed or deleted files.

Tools for Analysis

• Registry Analysis Tools: Tools like AccessData Registry Viewer or RegRipper can facilitate viewing and analyzing the NTUSER.DAT hive.

• Digital Forensics Platforms: Comprehensive forensics suites like EnCase or FTK can parse the registry and automatically extract ACMRU data, presenting it in an easily understandable format.

ACMRU search history in Windows XP offers a unique window into user behavior, capturing the essence of user interactions through the Search Assistant. By meticulously analyzing these entries, digital forensic investigators can gain valuable insights into past activities, revealing much about a user's actions and intentions on a system.