function fred_report_info() {
var info={report_cat : "NTUSER",
report_name : "Recent documents",
report_author : "Gillen Daniel",
report_desc : "Dump recent docs",
fred_api : 2,
hive : "NTUSER"
};
return info;
}
function IsValid(val) {
if(typeof val !== 'undefined') return true;
else return false;
}
function fred_report_html() {
println("
Recent documents
");
// Get list of recent docs
var recent_docs=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs","MRUListEx");
if(IsValid(recent_docs)) {
// Iterate over all recent docs
var i=0;
var runlist=RegistryKeyValueToVariant(recent_docs.value,"uint32",i);
if(Number(runlist)!=0xffffffff) {
println(" ");
println("
");
while(Number(runlist)!=0xffffffff) {
var entry=GetRegistryKeyValue("\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs",runlist.toString(10));
println(" ",RegistryKeyValueToVariant(entry.value,"utf16",0)," |
");
i+=4;
runlist=RegistryKeyValueToVariant(recent_docs.value,"uint32",i);
}
println("
");
println(" ");
} else {
println(" ");
println(" The list of recent documents is empty.");
println("
");
}
} else {
println(" ");
println(" This registry hive does not contain a list of recent documents!");
println("
");
}
}