function fred_report_info() {
var info={report_cat : "NTUSER",
report_name : "Windows 7 search keywords",
report_author : "Gillen Daniel",
report_desc : "Dump Windows 7 search keywords",
fred_api : 2,
hive : "NTUSER"
};
return info;
}
function IsValid(val) {
if(typeof val !== 'undefined') return true;
else return false;
}
function fred_report_html() {
println("
Document and folder search keywords
");
// Get list of search keys
var mrulist=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery","MRUListEx");
if(IsValid(mrulist)) {
// Iterate over all items
var i=0;
var runlist=RegistryKeyValueToVariant(mrulist.value,"uint32",i);
if(Number(runlist)!=0xffffffff) {
println(" ");
println("
");
while(Number(runlist)!=0xffffffff) {
var entry=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery",runlist.toString(10));
println(" ",RegistryKeyValueToVariant(entry.value,"utf16",0)," |
");
i+=4;
runlist=RegistryKeyValueToVariant(mrulist.value,"uint32",i);
}
println("
");
println(" ");
} else {
println(" ");
println(" The list of document and search keywords is empty.");
println("
");
}
} else {
println(" ");
println(" This registry hive does not contain a list of document and folder search keywords!");
println("
");
}
}