|Original TypedUrls Dataset|
|Original TypedUrlsTime Dataset|
|Original RegRipper Values|
|URL3 Deleted in TypedUrls|
|Url3 remains in the TypedUrlsTime|
|Adding a New TypedUrls to this|
|RegRipper Plugin Values|
Since we have identified the behavior with these two data sets if we delete a value from the TypedUrls, I was wondering what would happen if we deleted a value from the TypedUrlsTime and retain the corresponding key in the TypedUrls. I decided to delete the Url3 version that corresponded with my visit to Wired.com.
|Visiting Espn after deletion of TypedUrlsTime Key.|
|Url4 corresponds to Wired.com, it is now 00.|
We can see that even though I deleted the value, when you type in a new address that is added to the TypedUrls keys it will recreate the the missing TypedUrlsTime value. Since the OS does not have the actual time that was visited to pass to this key, the value is now 00 00 00 00 00 00 00 00. Looking at the RegRipper data, we can see that the new visit to Wired happened Thu Jan 1 1970.
|RegRipper Data.. 1970!!|
|Dataset after Url1 and Url8 change|
|url1 and url8 dates messed up.|
|TypedUrlsTime after new site added.|
|RegRipper Plugin Values after new site|
|After changing the Url3 and Url10 values.|
|RegRipper after the change|
**** Update 7/4/10 ****
My hives if you want to analyze them are here.
I have used RegSlack in an attempt to pull back deleted files. I was unable to extract anything from the slack space. This was the only Deleted Key that was found.
### Deleted Key ###
Offset: 0x7abb8 [Wed Jul 4 15:04:53 2012]
Number of values: 0
Recovered 1 keys and 0 values: #0 keys from allocated space.
Rejected 0 keys and 0 values.