feat: Add search history extraction (Get-SearchHistory.ps1)
Extract Windows Search queries, typed paths, and Run dialog history from registry (WordWheelQuery, TypedPaths, RunMRU). Includes warnings about Windows 11 limitations - modern search without Microsoft account doesn't persist history due to cloud-first design. Update TODO.md.
This commit is contained in:
10
TODO.md
10
TODO.md
@@ -25,7 +25,7 @@
|
||||
### Browser & Search History
|
||||
- [ ] Browser history - Edge, Chrome, Firefox artifacts
|
||||
- [x] Typed URLs - URLs manually typed in browsers
|
||||
- [ ] Search terms - Windows Search history
|
||||
- [x] Search terms - Windows Search history (Get-SearchHistory.ps1)
|
||||
|
||||
### File Access
|
||||
- [ ] LNK files - Shortcut files showing file access
|
||||
@@ -33,11 +33,11 @@
|
||||
- [ ] Shell Bags - Folder access history
|
||||
|
||||
### System Information
|
||||
- [ ] Computer name - System identification
|
||||
- [ ] Timezone - System timezone settings
|
||||
- [ ] Last shutdown time
|
||||
- [x] Computer name - System identification (Get-Info.ps1, winfetch.ps1)
|
||||
- [x] Timezone - System timezone settings (Get-Info.ps1)
|
||||
- [x] Last shutdown time (Get-Info.ps1 - shows Last Boot)
|
||||
- [ ] Installed programs - Software inventory
|
||||
- [ ] System uptime history
|
||||
- [x] System uptime history (Get-Info.ps1, winfetch.ps1)
|
||||
|
||||
### Persistence Mechanisms
|
||||
- [ ] Run/RunOnce keys - Programs that auto-start
|
||||
|
||||
Reference in New Issue
Block a user