TypedURLs
Internet Explorer / Edge Legacy registry key storing the last 25 URLs a user typed manually into the address bar — stronger evidence than a general visit record.
Where to find it
Default filesystem paths and registry locations. Collect these with your preferred live-response or disk-image tooling.
- $HKCU\Software\Microsoft\Internet Explorer\TypedURLs
- $HKCU\Software\Microsoft\Internet Explorer\TypedURLsTime
Forensic significance
Common scenarios in which this artifact becomes decisive evidence.
- Distinguishing deliberate navigation from clicked links
- Detecting C2 domain entry during investigation
- Phishing — user-typed variants of legitimate domains
MITRE ATT&CK mapping
Techniques this artifact can help detect or substantiate. Click a technique to view the official MITRE entry.
Tools that parse it
unJaena AI and other DFIR tools commonly used to extract evidence from this artifact.
Related artifacts
Shell Bags
Windows Explorer view preferences recorded per-folder in UsrClass.dat. Shell Bags prove a user navigated to a folder, even after the folder or attached volume is long gone.
Amcache.hve
Compatibility database introduced in Windows 8 that records every PE file executed on the system, including SHA-1 hash, full path, publisher, and first-seen timestamp.
UserAssist
Per-user registry key recording GUI-launched programs with ROT13-obfuscated paths, focus count, and last execution time — proving interactive user execution of a binary.
MUICache
Per-user cache of application display names written the first time a binary runs. Every entry is evidence that the user ran that binary at least once.
Stop parsing artifacts by hand
unJaena AI ingests disk images, live-response output, and mobile backups, then automatically correlates every artifact on this page — and 200+ more — into an investigator-ready timeline.
Try unJaena AI →