The UserAssist artifact identifies graphical user interface (GUI) application execution on Windows machines. This artifact stores differing amounts of information depending on the version of Windows OS. To identify the data specific to certain applications, we have to decode the registry key name as it is stored as the ROT13-encoded path and name of the application. As an example, the UserAssist value data for Windows XP and Vista is 16 bytes in length, and it stores the following:
- The last execution time in UTC (in FILETIME format)
- Execution count
- Session ID
The last execution time information is stored as a Windows FILETIME object. This is another common representation of time that differs from the UNIX timestamps we've seen in previous chapters. We will show how this timestamp can be interpreted within Python and displayed as human-readable, later in this...
