I had an interesting discussion with Hans Heins concerning the timestamp displayed by my UserAssist tool.
The first version of the UserAssist tool would only decode the UserAssist registry keys of the account under which it was running. And thus it made sense to display the timestamp in local time format, even if the entry is stored in UTC.
I added a warning about the time zones when I added registry file import functions, but this was confusing.
This new version of the UserAssist tool adds an extra column, with the timestamp in UTC:
And I’ll be posting a new version to support the new UserAssist registry key format of Windows 7 and Windows 2008 R2.
Download:
MD5: A5244C7F83E0DE70600E27F5D3B8AD7D
SHA256: 7E2D107BE84FBBF7E79F1BD11703401A374B5138B2F77E4FF8AFE1A3E749CCDA
Didier Stevens 