[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-292244-105":59,"doc-detail-292244-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","registry-quick-find-chart-for-windows-forensic-registry-locations-im-and-browser-data","Registry Quick Find Chart - For Windows Forensic Registry Locations - IM and Browser Data","","Registry Quick Find Chart compiles common Windows and Windows Internet-related registry locations that help investigators locate data of forensic interest. It organizes key artifacts by application, including AOL Instant Messenger, ICQ, Internet Explorer, MSN Messenger, Outlook and related messaging clients, and additional system areas such as system information, networking, and user application data. For each entry, the chart specifies the registry file, the precise key location, what information it holds, and when that information is typically updated.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/registry-quick-find-chart-for-windows-forensic-registry-locations-im-and-browser-data/292244/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/registry-quick-find-chart-for-windows-forensic-registry-locations-im-and-browser-data/292244.png","ImageObject",300,407,{"name":92,"@type":93},"Nguyễn Văn Học","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",13,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What does the Registry Quick Find Chart cover?","Question",{"text":113,"@type":114},"It reviews common registry locations in Windows and Windows Internet-related systems where data of forensic interest can be found. It organizes the locations by application and by registry area.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Which registry artifacts are listed for AOL Instant Messenger?",{"text":118,"@type":114},"The chart lists items such as away messages, file transfer and sharing settings, the last user, profile information, recent contacts, registered users, and the saved buddy list path. Each entry includes the registry file, location, description, and typical update timing.",{"name":120,"@type":111,"acceptedAnswer":121},"How does the chart handle Internet Explorer forensic information?",{"text":122,"@type":114},"It provides multiple Internet Explorer-related registry keys for items such as auto logon credentials, search terms, general settings, URL history retention, typed URLs, web form data, autocomplete passwords, autocomplete web addresses, and the default download directory.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},292244,1789649383,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145,"preview_page_count":4},1374402739827,"https://ap-avatar.wpscdn.com/avatar/14000c97e7351f1a627?x-image-process=image/resize,m_fixed,w_180,h_180&k=1787885694763230660","AccessData  \nRegistry Quick Find Chart  \nRegistry Quick Find Chart  \nThis appendix reviews common locations in the Windows and Windows Internet-related registries where you can find data of forensic interest.  \n• AOL Instant Messenger on page 2  \n• ICQ on page 3  \n• Internet Explorer on page 3  \n• MSN Messenger on page 4  \n• Outlook and Outlook Express on page 5  \n• Windows Messenger on page 5  \n• Yahoo Messenger on page 6  \n• System Information on page 7  \n• Networking on page 9  \n• User Data on page 10  \n• User Application Data on page 13  \nAOL INSTANT MESSENGER  \n\n| Information | File | Location | Description | When Updated |\n| --- | --- | --- | --- | --- |\n| Away Messages | NTUSER.DAT | \\Software\\America Online\\ AOL Instant Messenger(TM)\\ CurrentVersion\\Users\\screen name\\ IAmGoneList | Shows default and customized Away messages. | Immediately |\n| File Transfers & Sharing | NTUSER.DAT | \\Software\\America Online\\ AOL Instant Messenger(TM)\\ CurrentVersion\\Users\\screen name\\ Xfer | Shows settings for file transfers and sharing. | Immediately |\n| Last User | NTUSER.DAT | \\Software\\America Online\\ AOL Instant Messenger (TM)\\ CurrentVersion\\Login-Screen Name | Shows the screen name of the last logged-in user. | At login |\n| Profile Info | NTUSER.DAT | \\Software\\America Online\\ AOL Instant Messenger(TM)\\ CurrentVersion\\Users\\screen name\\\u003Cbr>DirEntry | Shows user profile information (optional) . | Immediately |\n| Recent Contacts | NTUSER.DAT | Software\\America Online\\ AOL Instant Messenger\\ CurrentVersion\\users\\username\\ recent IM ScreenNames | Shows a list of recently contacted buddies. | When the\u003Cbr>application closes. |\n| Registered Users | NTUSER.DAT | \\Software\\America Online\\ AOL Instant Messenger (TM)\\ CurrentVersion\\Users | Shows registered AIM users on the machine. | At sign-on |\n| Saved\u003Cbr>Buddy List | NTUSER.DAT | \\Software\\America Online\\ AOL Instant Messenger(TM)\\ CurrentVersion\\Users\\username\\ ConfigTransport | Shows the directory path of a saved Buddy List, a BLT file. | Immediately |\n\n2 ©1987-2005 AccessData Corporation. All Rights Reserved.  \nICQ  \n\n| Information | File | Location | Description | When Updated |\n| --- | --- | --- | --- | --- |\n| ICQ | NTUSER.DAT | \\Software\\Mirabilis\\ICQ\\* | Lists IM contacts, file transfer information, etc. | Not applicable |\n| ICQ\u003Cbr>Information | SOFTWARE | \\Software\\Mirabilis\\ICQ\\Owner | Stores the User Identification Number (UIN) . | At logon |\n| Last User | NTUSER.DAT | \\Software\\Mirabilis\\ICQ\\ Owners-LastOwner | Shows the last logged-in user. | At login |\n| Nickname | NTUSER.DAT | \\Software\\Mirabilis\\ICQ\\ Owners\\UIN-Name | Nickname of user (optional value) . | At login |\n| Registered Users | NTUSER.DAT | \\Software\\Mirabilis\\ICQ\\ Owners\\UIN | UIN folder is named for the user. | At login |\n\nINTERNET EXPLORER  \n\n| Information | File | Location | Description | When Updated |\n| --- | --- | --- | --- | --- |\n| IE Auto Logon and password | NTUSER.DAT | \\Software\\Microsoft\\ Protected Storage System Provider\\\u003Cbr>SID\\Internet Explorer\\ Internet Explorer-URL:\u003Cbr>StringData | Stores IE auto logon IDs and passwords with date and timestamp. | Immediately |\n| IE Search Terms | NTUSER.DAT | \\Software\\Miscrosoft\\\u003Cbr>Protected Storage System Provider\\SID\\Internet Explorer\\ Internet Explorer-q:StringIndex | Stores IE search terms with date and time stamp. | Immediately |\n| IE Settings | NTUSER.DAT | \\Software\\Microsoft\\Internet Explorer\\\u003Cbr>Main | Stores IE settings such as start page, save directory, homepage, and download location. | Immediately |\n| IE URL History—\u003Cbr>Days Saved | NTUSER.DAT | \\Software\\Microsoft\\Windows\\ CurrentVersion\\Internet Settings\\ URL History-DaysToKeep | The number of days the system stores URLs visited in IE. The default is 20 days. | Immediately |\n\n\n| Information | File | Location | Description | When Updated |\n| --- | --- | --- | --- | --- |\n| Typed\u003Cbr>URLs | NTUSER.DAT | \\Software\\Microsoft\\Internet Explorer\\\u003Cbr>Typed URLs | Stores data entered into the URL addre","cbCaih4nPnCn2aPg","https://ap.wps.com/l/cbCaih4nPnCn2aPg","pdf",125352,17,"English","# Registry Quick Find Chart\n## AOL Instant Messenger\n## ICQ\n## Internet Explorer\n## MSN Messenger\n## Outlook and Outlook Express\n## Windows Messenger\n## Yahoo Messenger\n## System Information\n## Networking\n## User Data\n## User Application Data","[{\"question\":\"What does the Registry Quick Find Chart cover?\",\"answer\":\"It reviews common registry locations in Windows and Windows Internet-related systems where data of forensic interest can be found. It organizes the locations by application and by registry area.\"},{\"question\":\"Which registry artifacts are listed for AOL Instant Messenger?\",\"answer\":\"The chart lists items such as away messages, file transfer and sharing settings, the last user, profile information, recent contacts, registered users, and the saved buddy list path. Each entry includes the registry file, location, description, and typical update timing.\"},{\"question\":\"How does the chart handle Internet Explorer forensic information?\",\"answer\":\"It provides multiple Internet Explorer-related registry keys for items such as auto logon credentials, search terms, general settings, URL history retention, typed URLs, web form data, autocomplete passwords, autocomplete web addresses, and the default download directory.\"}]","Registry Quick Find Chart - For Windows Forensic Registry Locations - IM and Browser Data | PDF",43]