Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Windows - Get last accessed date and time of all applications ======

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall does not contain the last accessed date and time, but does contain a list of all applications installed.

Get the file path of the installed applications: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

The properties of the file from the file path should show last accessed date and time.

<WRAP alert>
**WARNING:**  The registry path with the "App Paths" may not contain all software.  

<WRAP todo>
**TODO:**  Check if this is True.
</WRAP>

</WRAP>



----

Several Registry Keys store information about programs that have been executed previously on the system:

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

----

The list of previously executed programs is collected from the following data sources:
Registry Key: HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
Windows Prefetch folder (C:\Windows\Prefetch)