Networking
- Networking
Windows
Linux
Enterprise Architecture
Mac
- Forensics
  - Page 3
Attacker Information
IR Playbook
- Activity from Unmanaged Host
- Recommendations
Reverse Engineering
- Python - Pyinstaller

Powered by GitBook

On this page

What Is?
Forensic Value:
File Location:
Parse Data:
Considerations:
Example:
Analysis Tips:
Anti-Forensics:

Windows

Forensics

Evidence of Execution

Office Apps Forensics

Trusted Documents

PreviousFile MRU NextRun MRU

Last updated 10 months ago

What Is?

Forensic Value:

Tracks documents that the user has given permissions to. Can be used to filter out documents that couldn't have executed or prove execution.

File Location:

NTUSER\SOFTWARE\Microsoft\OFfice<Version><AppName>\Security\Trusted Documents\TrustedRecords
- Trusted for editing: 0x01000000
- Trusted for macro execution: 0xFFFFFF7F

Parse Data:

Considerations:

Example:

Analysis Tips:

Anti-Forensics: