*Key 🔑: NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps
.
Similar to User Assist. It also shows files and applications that were used through this application. This key consists of sub-keys that are marked with the application’s GUID. Some of them will have Recent Items
sub-key (10 max), each has Last Write Time
(Windows 64-bit, little-endian).
⚠️ Not all Win10 machines will have this key.
Key 🔑: Software\Microsoft\Windows\Current Version\Explorer\RunMRU
.
A list of the programs that have been run from the Run command is shown. Each time you use a command that has already been stored, it moves to the top of the list.