UserAssistView – Display UserAssist Items

One of the programs that will be helpful in the incident response from Nirsoft is UserAssistView.On windows operating system we have several registry keys that allow incident handler to find the required artifacts and one of them is the userassisst registry key. The UserAssist key contains information about the exe files and links that were opened frequently. This may allow investigator to know what was installed on the system and if the application installed have been used to conduct the attack.

Normally the incident handler will count on several sources such as logs, data and software so he may confirm and match each item to the scenario of the attack.

UserAssistView - Display list UserAssist Items

UserAssistView – Display list UserAssist Items

UserAssist comes mostly to uncover windows hidden activity and history of installed application on the system even if they were removed and not used anymore. As almost all Nirsoft utility this tool will not require any installation process or additional DLL files. In order to start using it, simply run the executable file – UserAssistView.exe.

You can read more and download this tool over here:

Notify of
Inline Feedbacks
View all comments