drop ntuser.dat reg export · extract urls typed directly into internet explorer edge and explorer address bar · typedpaths folder navigation history · decode rot13 userassist correlation · timeline of user navigation · runs locally
drop ntuser.dat reg export · local only
heuristic screener · vendor schema varies · not definitive proof