What Does This Tell You - The Answer

And the answer is ......... a program called "Advanced Registry Fix" was run on the system. I saw this program advertised in Bits Du Jour which I blogged about here. There is a free download for the program so I thought I would download it and try it out seeing what it actually did to the regstry.

One of the things I found is that to "Clean" up the registry what it does for the MRUList is to see if the files still exist on the system. If they do not then it removes the file name from the MRUList (a and b were removed), the thing is that it does not remove the entry from the MRUList for that item so that is why Harlans RegRipper displayed 2 blank lines, it expected entries there becuase the MRUList said there were suppose to be entries there, I was not sure how RegRipper would handle this when I first saw what Advanced Registry Fix did, and was happy to see how it handled it (great job Harlan).

Here is the before image of the registry

a                 REG_SZ     F:\methodology_form_blank.pdf
b                 REG_SZ     F:\report_blank.pdf
c                 REG_SZ     C:\Mark\dc3_challenge\methodology_form_blank.pdf
d                 REG_SZ     C:\Mark\dc3_challenge\report_blank.pdf
MRUList   REG_SZ     cdba

Where the F:\ drive was a usb thumb drive.

Here is the after image of the registry after running "Advanced Registry Fix"

c                 REG_SZ     C:\Mark\dc3_challenge\methodology_form_blank.pdf
d                 REG_SZ     C:\Mark\dc3_challenge\report_blank.pdf
MRUList   REG_SZ     cdba

Another thing I did find out is that once you open a program that will write to the MRUList it will correct everything (MRUList will have the non existant entries removed).

This just goes to show you how a $10 (price on Bits du Jour) to $20 (retail price) piece of software can really throw you for a loop and get you thinking that someone was deliberatly trying to hide something when they were not, they were just trying to keep their system running in an optimal state by using valid system maintenance software.


Thoughts/Questions/Comments????