Registry - TypedURLs

Overview

The TypedURLs registry key tracks URLs entered (typed, pasted, or auto-completed) in the Internet Explorer (IE) web browser search bar. Web searches are not stored, only the URLs entered are tracked.

Starting with IE8, entries are added / updated in near real-time.

Information of interest

Each URL is stored in a dedicated value under the Explorer\TypedURLs key, as url1 to url[N]. The values are stored in inverse chronological order.

The last write timestamp of the key is thus the timestamp of visit of the most recently visited URL.

References

• Crucial Security Forensics Blog - Paul Nichols - TypedURLs (Part 1)

• Crucial Security Forensics Blog - Paul Nichols - TypedURLs (Part 2)