Posts Tagged ‘TypedURLs’


Posted by:  /  Tags: , ,

Author Name
Joe Garcia

Artifact Name

This key is added and updated in the Windows Registry when a user types directly into the Address Bar in the Internet Explorer web browser.  It also updates whenever the user copy & pastes a website into the Address Bar.  It does not update when the user clicks on a link.  This means that the user would have to have intentionally

It will save a maximum of 25 entries.  When the 26th entry is made, the first entry is deleted to make room for the newly added data.  The entries are displayed (top to bottom) from most recent to earliest.

The below screenshot shows the TypedURLs parsed out side by side in Harlan Carvey’s RegRipper and AccessData’s Registry Viewer:

Registry Keys
NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLs

File Locations
C:\Documents and Settings\USERPROFILE\NTUSER.DAT

Research Links (Scroll to page 4 of this document)

Forensic Programs of Use

AccessData Registry Viewer: