Ever wondered if Windows keep a history of files that are executed on your computer? In other words, does Windows store a database of list of files ending with extension .exe, that are run on your PC? The answer is Yes!, but normally you can’t view it due to storage in the form of registry entries, with in the Windows Registry file.
This is how forensic experts dig out information when a PC is analysed. ExecutedProgramList, a freeware program lets you do the forensics yourselves, by extracting the previously executed programs list on your Windows PC. It takes out the information from the following Windows Registry Keys:
- Registry Key: HKEY_CURRENT_USER\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
- Registry Key: HKEY_CURRENT_USER\Microsoft\Windows\ShellNoRoam\MUICache
- Registry Key: HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
- Registry Key: HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
- Windows Prefetch folder (C:\Windows\Prefetch)
Upon first run, the program may take a minute or two to scan your PC and retrieve the information, but subsequent runs should be faster.
To get a more detail picture of a particular executable file, right-click on it and select Properties. You can also multiple select items, view its HTML Report, and save as TXT or HTML file.
It shows some very vital information such as File Last Modified, File Created On, Last Executed On, etc..
ExecutedProgramsList is a 100% free portable utility that has no malware, no adware, doesn’t hjack browsers, and doesn’t nag for upgrade to pro version.
- User Interface
Reviewed Version: 1.0
Portable, extremely small file size
100% Free, No Malware
Tiny icons, UI not suitable for touch
Misses some entries
Works with Windows 8.1/8/7/Vista/XP.
Developer's website: Nirsoft