01Location
- NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
- NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\Settings (NoLog, NoEncrypt; absent by default)
02Questions it answers
- Which programs or shortcuts did a specific user launch through Explorer?
- How many times was each launched, and when last?
- Was a program started from a shortcut rather than directly?
03Format and versions
| Format | REG_BINARY values whose names are ROT-13 encoded (only ASCII A–Z and a–z are rotated). Version 3 data (2000 to Vista) is 16 bytes; version 5 data (2008, 7, 8) is 72 bytes with the execution count at offset 4 and the last execution FILETIME at offset 60. |
|---|---|
| Applies to | Windows 2000 and later. GUIDs {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} and {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} are observed on Windows 7, 8 and 10; winreg-kb assumes they cover executables and shortcuts respectively. |
04Key fields
| Field | What it tells you |
|---|---|
| Value name | ROT-13 encoded path or identifier of the launched item. |
| Number of executions | Offset 4 in both version 3 and version 5 data. |
| Focus count / focus time (v5) | Offsets 8 and 12; commonly described this way but marked unknown by winreg-kb. |
| Last execution time | Offset 8 (v3) or 60 (v5); 0 if not set. |
| UEME_CTLSESSION | Session value with a different structure from the item values. |
| Version | REG_DWORD in each GUID key that selects the data format (3 or 5). |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Last execution time | FILETIME (UTC) | Last launch through Explorer for that item; 0 when not set. |
| Count key last written time | FILETIME (UTC) | Applies to the key as a whole, not to an individual value. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Load each user's NTUSER.DAT with its transaction logs.
- Enumerate the GUID sub-keys, read the Version value and decode value names with ROT-13 (unless NoEncrypt is set).
- Parse counts and last execution times according to the data version.
- Correlate with Prefetch, BAM, Jump Lists and LNK files.
07Interpretation pitfalls
- Only programs launched via Windows Explorer are recorded; command-line or service starts are not covered.
- Logging can be disabled with NoLog and name obfuscation with NoEncrypt in the Settings sub-key.
- Several version 5 fields are not formally documented; report them as unverified.
09Sources
- User Assist key libyal / winreg-kb · checked 2026-10-14
- RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14