Author Name
Joe Garcia

Artifact Name
TypedURLs

Description
This key is added and updated in the Windows Registry when a user types directly into the Address Bar in the Internet Explorer web browser.  It also updates whenever the user copy & pastes a website into the Address Bar.  It does not update when the user clicks on a link.  This means that the user would have to have intentionally

It will save a maximum of 25 entries.  When the 26th entry is made, the first entry is deleted to make room for the newly added data.  The entries are displayed (top to bottom) from most recent to earliest.

The below screenshot shows the TypedURLs parsed out side by side in Harlan Carvey’s RegRipper and AccessData’s Registry Viewer:

Registry Keys
NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLs

File Locations
C:\Documents and Settings\USERPROFILE\NTUSER.DAT

Research Links
http://www.accessdata.com/downloads/media/Registry%20Quick%20Find%20Chart%20%207-22-08.pdf (Scroll to page 4 of this document)

Forensic Programs of Use
RegRipper: www.regripper.net

AccessData Registry Viewer: www.accessdata.com/downloads.html