NTUSER.DAT

Location

Common Names

Description

Per-user registry hive containing user-specific settings including recently opened files (RecentDocs), typed URLs, Run/RunOnce persistence keys, UserAssist encoded program execution records, and shell bags.

Forensic Value

UserAssist entries (ROT13-encoded) record every GUI program a user launched with execution count and last-run timestamp, providing evidence of interactive attacker tool usage. Run/RunOnce keys reveal per-user persistence mechanisms. RecentDocs and typed paths reconstruct the files and directories the user accessed.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target RegistryHives

reg save HKU\<SID> C:\output\NTUSER.DAT

rip.exe -r C:\output\NTUSER.DAT -p userassist

RECmd.exe -f C:\output\NTUSER.DAT --bn BatchExamples\RECmd_Batch_MC.reb --csv C:\output --csvf NTUSER_RECmd.csv

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References