All RSR Files
|
NTUSER.DAT – Computer Networks.rsr
• Computer Networks documents the registry subkey that tracks network systems the machine has been attached to. It displays data to the user interface in My Network Places, storing the list of other users on the system.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions
• RSR File Hash: 76ea68c90eb02d217169bf41104108db
|
NTUSER.DAT – IE E-Mail Account Manager.rsr
• Displays the Internet Account Manager information for e-mail accounts set up locally using Outlook or Outlook Express. It ties into information seen in the PSSP regarding locally stored email passwords in the INETCOMM Server Passwords subkey.
• HKCU\Software\Microsoft\Internet Account Manager\<account name>
• RSR File Hash: d1287dd397c1481e70b4c67b29d77549
|
NTUSER.DAT – IE Info.rsr
• This RSR displays information regarding the Internet Explorer settings from the Main subkey, URL History Setting showing the number of days the system retains Internet history, and the user’s Favorites as seen in the IE Favorites drop down menu which are also stored in the registry.
• HKCU\Software\Microsoft\Internet Explorer\Main
• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History DaysToKeep
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
• RSR File Hash: 799c44e9b8caa3acea6f7b29720d7bab
|
NTUSER.DAT – Map Network Drive MRU.rsr
• This MRU registry key set displays mapped network drives it has been connected to draw the display of other users on the system from My Network Places.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
• RSR File Hash: ee38a2176620dcbc852a7f9852e112ff
|
NTUSER.DAT – Media Player MRUs.rsr
• MRU list of last played files through the application Media Player.
• HKCU\Software\Microsoft\Windows\MediaPlayer\Player\RecentFileList
• RSR File Hash: eb15afe058238b8881a13f78bba293b7
|
NTUSER.DAT – PSSP Information.rsr
• Protected Storage Information in Windows XP/Windows 2000 systems. Includes the following: Outlook and Outlook Express stored passwords, website form data, stored website logon user names and passwords, and Internet search engine queries.
• HKCU\Software\Microsoft\Windows\Protected Storage System Provider\<sid>\Identification\INETCOMM Server Passwords
• HKCU\Software\Microsoft\Windows\Protected Storage System Provider\<sid>\Internet Explorer\Internet Explorer
• RSR File Hash: 733d0901f3e2912bda36490ff8b71cd0
|
NTUSER.DAT – Recent Docs.rsr
• MRU list for recently opened documents by extension.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\<extension>
• RSR File Hash: 7cb15b97bd4467ab8c7f783758e1f2e2
|
NTUSER.DAT – RunMRUs.rsr
• MRU list used to generate the auto complete in the Start > Run drop down menu list.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
• RSR File Hash: 75c734002f519c4d5d5a72788ebad789
|
NTUSER.DAT – Startup Software by User.rsr
• Standard list of software initiated upon bootup by a specific user.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• RSR File Hash: 1314d841e944ca131d5867d70ec4eb09
|
NTUSER.DAT – Typed URLs.rsr
• MRU list of the last 25 URL addresses typed or copy/pasted into the Internet Explorer browser.
• HKCU\Software\Microsoft\Internet Explorer\TypedURLs
• RSR File Hash: d35e567079c4ae6740343ad880c8ff0c
|
NTUSER.DAT – Vista ComDlg32.rsr
• For Vista systems, this recovers the MRU list of applications where the default Windows
Save/Save As dialog box was used.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
• RSR File Hash: bbb9c04cec33d404fb1edef5d28c5b08
|
NTUSER.DAT – WinZip Information.rsr
• This recovers WinZip 11 file list MRU information for Zips and extracted to files.
• HKCU\Software\Nico Mak Computing\WinZip
• RSR File Hash: c83beeabe25fac320ea57c8128db49f6
|
NTUSER.DAT – XP ComDlg32 MRUs.rsr
• For Vista systems, this recovers the MRU list of applications where the default Windows
Save/Save As dialog box was used.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
• RSR File Hash: 59d5877d8c8d6560607056496a143373
|
NTUSER.DAT – XP Local Search Terms.rsr
• This recovers the four varieties of user’s local searches initiated with the Start > Search utility in Windows 2000 and Windows XP.
• HKCU\Software\Microsoft\Search Assistant\ACMru\5001 (Local Internet Searches)
• HKCU\Software\Microsoft\Search Assistant\ACMru\5603 (All Files and Folders)
• HKCU\Software\Microsoft\Search Assistant\ACMru\5604 (Pictures Music or Video)
• HKCU\Software\Microsoft\Search Assistant\ACMru\5647 (Computers or People)
• RSR File Hash: a958b40fdfcb49b0dbe08bc9c2145fe0
|
