UserAssist

The UserAssist feature in Windows is a component of the operating system that tracks the execution of desktop applications. This feature is part of the Windows Explorer shell and is used primarily to populate the list of frequently used programs in the Start menu. However, from a forensic perspective, UserAssist data is invaluable as it provides insights into user activity by logging executed GUI-based programs.

Location of UserAssist Data

UserAssist data is stored in the NTUSER.DAT registry hive of a user's profile. The specific path within the NTUSER.DAT hive is:

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

Each {GUID} under the UserAssist key represents a different set of tracked activities. The data is organized into subkeys, each corresponding to a unique UserAssist GUID.

GUIDs and Program Locations

• Windows XP has its set of GUIDs for tracking activities.

• Windows 7–10 introduced new GUIDs reflecting changes in the operating system's architecture and features.

For instance:

• CEBFF5CD...: Tracks the execution of executable files.

• F4E57C4B...: Tracks the execution of shortcut files.

Additionally, specific GUIDs are associated with different program locations and special folders, such as Program Files, System directories, Desktop, Documents, Downloads, and User Profiles.

• 6D809377 - ProgramFilesX64

• 7C5A40EF - ProgramFilesX86

• 1AC14E77 - System

• D65231B0 - SystemX86

• B4BFCC3A - Desktop

• FDD39AD0 - Documents

• 374DE290 - Downloads

• 0762D272 - UserProfiles

Interpretation of UserAssist Data

• ROT-13 Encoding: All values within the UserAssist entries are encoded using ROT-13, a simple cipher that shifts each letter by 13 positions in the alphabet. This means that to interpret the data, one must decode it from ROT-13 to plain text.

• Decoding Example: A program name like "HelloWorld" encoded in ROT-13 would appear as "UryybJbeyq" in the UserAssist data.

• Entries: Each entry under a GUID in the UserAssist key includes data about executed programs, such as:

  • The encoded path or name of the executable.

  • A count of how many times the application was launched.

  • Timestamps indicating the last time the application was executed.

Forensic Importance

• User Activity: UserAssist data can be used to establish a timeline of user activity on a system, showing when specific applications were launched.

• Program Execution: It provides evidence of program execution, which can be crucial in investigations involving malware or unauthorized software usage.

• Artifact Correlation: The information can be correlated with other forensic artifacts, such as Prefetch files, Event Logs, and ShimCache data, to build a comprehensive picture of user actions.

Extracting and Analyzing UserAssist Data

1. Accessing NTUSER.DAT: Use forensic tools to load the NTUSER.DAT hive of the user profile you are investigating. This often requires copying the hive from a forensic image or a live system.

2. Decoding ROT-13: Utilize scripts or forensic software features to decode ROT-13 encoded paths and names. Various online tools can perform ROT-13 decoding as well.

3. Analysis Tools: Tools like RegRipper have plugins specifically designed to parse and decode UserAssist data, making the analysis more straightforward.

4. Document Findings: Keep detailed notes on decoded paths, execution counts, and timestamps for each analyzed entry. This documentation is critical for reporting and further investigation.