function fred_report_info() { var info={report_cat : "NTUSER", report_name : "Windows 7 search keywords", report_author : "Gillen Daniel", report_desc : "Dump Windows 7 search keywords", fred_api : 2, hive : "NTUSER" }; return info; } function IsValid(val) { if(typeof val !== 'undefined') return true; else return false; } function fred_report_html() { println("

Document and folder search keywords

"); // Get list of search keys var mrulist=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery","MRUListEx"); if(IsValid(mrulist)) { // Iterate over all items var i=0; var runlist=RegistryKeyValueToVariant(mrulist.value,"uint32",i); if(Number(runlist)!=0xffffffff) { println("

"); println(" "); while(Number(runlist)!=0xffffffff) { var entry=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery",runlist.toString(10)); println(" "); i+=4; runlist=RegistryKeyValueToVariant(mrulist.value,"uint32",i); } println("
",RegistryKeyValueToVariant(entry.value,"utf16",0),"
"); println("

"); } else { println("

"); println(" The list of document and search keywords is empty."); println("

"); } } else { println("

"); println(" This registry hive does not contain a list of document and folder search keywords!"); println("

"); } }