WordWheelQuery (Win 7+)

WordWheelQuery is a Windows artifact that records the terms entered into the File Explorer search dialog by a user. Stored within the Windows Registry, specifically in the NTUSER.DAT file, it maintains an ordered list of search terms. These terms are stored in Unicode format and are organized based on the order of their usage, following a Most Recently Used (MRU) list pattern. This artifact provides valuable insights into the search behavior of a user, documenting the exact keywords searched in File Explorer.

Key Insights:

• Location in the Registry:

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

• Data Format:

  • Keywords are stored in Unicode.

• Ordering:

  • The search terms are listed in the MRUlist, indicating their temporal order of use.

Deeper Dive

• WordWheelQuery:

  • This registry value is instrumental for forensic analysts because it reveals the user's search history in File Explorer. By examining the MRUlist, investigators can ascertain the sequence of searches conducted by the user, which could be pivotal in understanding user behavior or in supporting investigations. The use of Unicode for storing search terms ensures that a wide range of characters, including non-English ones, is accurately recorded.

Analyzing The Artifact

1. Accessing the Registry File: Start by opening the NTUSER.DAT file of the user profile in question. This requires using a tool capable of loading and interpreting registry hive files.

2. Navigating to the Key: Locate the WordWheelQuery key within the path Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery.

3. Extracting Search Terms: Examine the MRUlist to retrieve and decode the Unicode search terms. The order of these terms will reflect their usage chronology.

4. Interpreting the Data: Analyze the extracted terms to understand the context of the searches. This might include identifying patterns, frequently searched terms, or specific files or topics of interest.

Tools for Analysis

• Registry Explorer: A powerful tool for navigating and analyzing Windows Registry files, offering a user-friendly interface for accessing NTUSER.DAT.

• AccessData FTK: Provides capabilities for loading and analyzing registry hives, among other forensic functionalities.

• Autopsy: An open-source digital forensics platform that can analyze Windows artifacts, including registry hives, to extract user activities.