This scripts reads recently-used application information from the following Registry path:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps

This information is linked to the operation of the Windows search function. It can be useful when trying to ascertain the applications and documents (recent items) accessed by the user. 

Each application that has no recent items will be represented by a single row in the output spreadsheet.

For applications that do have recent items, there will be one row per item, and the application-data will be repeated.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training