📎 AI Summary:
The thread discusses methods for locating installed software on Windows 10 for forensic purposes, with initial focus on registry paths where installation details are stored. Participants mention that built-in apps do not have specific file paths, as they can be located anywhere, often in Program Files directories or locations specified in environment variables. As a tip, one user suggests pinning the "Programs" folder in File Explorer to the Start and Quick Access menus for easier access to installed applications. Overall, the conversation offers useful registry locations and practical tips for finding installed software on Windows 10.
The thread discusses methods for locating installed software on Windows 10 for forensic purposes, with initial focus on registry paths where installation details are stored. Participants mention that built-in apps do not have specific file paths, as they can be located anywhere, often in Program Files directories or locations specified in environment variables. As a tip, one user suggests pinning the "Programs" folder in File Explorer to the Start and Quick Access menus for easier access to installed applications. Overall, the conversation offers useful registry locations and practical tips for finding installed software on Windows 10.
Solution
- Joined
- Jul 4, 2015
- Messages
- 8,995
Portable apps won't have a lot of artifacts, but there is a list in the registry of the execution I don't recall the path off the top of my head and the structure can be a little difficult to dissect but you can look at some of Eric Zimmermans tools.
You can grab the prefetch cache for a quick idea of what has been executed lately.
"Installed" applications will usually be stored in subkeys located under one of two registry keys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
32 bit applications on a 64-bit machine
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
You can grab the prefetch cache for a quick idea of what has been executed lately.
"Installed" applications will usually be stored in subkeys located under one of two registry keys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
32 bit applications on a 64-bit machine
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
- Joined
- Jul 4, 2015
- Messages
- 8,995
There isn't any requirement for software to be in any given location. The most common would be in Program Files and Program Files (x86), but really any path specified in the PATH environment variable will likely have applications and even more beyond that.