This key is added and updated in the Windows Registry when a user types directly into the Address Bar in the Internet Explorer web browser. It also updates whenever the user copy & pastes a website into the Address Bar. It does not update when the user clicks on a link. This means that the user would have to have intentionally
It will save a maximum of 25 entries. When the 26th entry is made, the first entry is deleted to make room for the newly added data. The entries are displayed (top to bottom) from most recent to earliest.
The below screenshot shows the TypedURLs parsed out side by side in Harlan Carvey’s RegRipper and AccessData’s Registry Viewer:
C:\Documents and Settings\USERPROFILE\NTUSER.DAT
http://www.accessdata.com/downloads/media/Registry%20Quick%20Find%20Chart%20%207-22-08.pdf (Scroll to page 4 of this document)
Forensic Programs of Use
AccessData Registry Viewer: www.accessdata.com/downloads.html