JoyShine Forensics Launch History
<Overview>
Shows surviving Windows records related to program starts, and reports what the scan could not examine.
Prefetch is a system-maintained record associated with program starts. It can be disabled, and older records are evicted.
UserAssist is a per-user shell record. Only profiles whose registry hives are available can be examined.
Many UserAssist entries carry a timestamp and a run count of zero.
The entry was created and stamped, but no launch was counted.
Those rows read "no counted launch" in the Detail column.
A timestamp on its own is not evidence that the program was started.
It only reads. There is no feature for deleting records.
<System Requirements>
• Windows 7 or later (64-bit)
• No additional runtime is needed
• The Prefetch records cannot be read without administrator rights
• File > Restart as administrator restarts the program with administrator rights
<Download>
▼ Download (121 KB)
The zip contains the executable, README.txt (English), and README(Japanese).txt.
<Disclaimer>
The author makes no warranty as to the accuracy or suitability of this program for any particular use.
<Contact / Error Reports>
https://lee22.net/contact.html