With Windows 7 and Windows Server 2008 R2, the binary data format of the values stored in the UserAssist registry keys has changed.
Here’s a partial description of the new format:
- the counter is 32-bits long, starting at byte 4 (first byte is byte 0)
- the timestamp (64-bits) starts at byte 60
- there is a 32-bit value that appears to be the total time an application has focus, expressed in milli-seconds (starts at byte 8 )
For more details, read my article in the new forensic magazine Into The Boxes.
Don’t forget to use the special version of my UserAssist tool on Windows 7 and Windows Server 2008 R2.
Didier Stevens 