feat: Add search history extraction (Get-SearchHistory.ps1)

Extract Windows Search queries, typed paths, and Run dialog history
from registry (WordWheelQuery, TypedPaths, RunMRU).

Includes warnings about Windows 11 limitations - modern search without
Microsoft account doesn't persist history due to cloud-first design.

Update TODO.md.
This commit is contained in:
2026-02-03 22:31:19 +01:00
parent aa4e6fa88f
commit ce250b9725
2 changed files with 200 additions and 5 deletions

10
TODO.md
View File

@@ -25,7 +25,7 @@
### Browser & Search History
- [ ] Browser history - Edge, Chrome, Firefox artifacts
- [x] Typed URLs - URLs manually typed in browsers
- [ ] Search terms - Windows Search history
- [x] Search terms - Windows Search history (Get-SearchHistory.ps1)
### File Access
- [ ] LNK files - Shortcut files showing file access
@@ -33,11 +33,11 @@
- [ ] Shell Bags - Folder access history
### System Information
- [ ] Computer name - System identification
- [ ] Timezone - System timezone settings
- [ ] Last shutdown time
- [x] Computer name - System identification (Get-Info.ps1, winfetch.ps1)
- [x] Timezone - System timezone settings (Get-Info.ps1)
- [x] Last shutdown time (Get-Info.ps1 - shows Last Boot)
- [ ] Installed programs - Software inventory
- [ ] System uptime history
- [x] System uptime history (Get-Info.ps1, winfetch.ps1)
### Persistence Mechanisms
- [ ] Run/RunOnce keys - Programs that auto-start