April 20, 2023, 9:39 a.m. | /u/buildingapcin2015

Computer Forensics www.reddit.com

I've been trying to find the source of the data stored in the windows 10 run dialogue box/autocomplete.The history is disabled and shows nothing:

https://preview.redd.it/vexdfqm6e0va1.png?width=612&format=png&auto=webp&v=enabled&s=d6b648e6ddbd1a5f49dc94ea58c6a52b883bb2f6

But if you start typing a path of a removable drive that's not connected you get a list of files that is no longer present:

https://preview.redd.it/526gh239e0va1.png?width=587&format=png&auto=webp&v=enabled&s=dbd014ab1fba5d97954b6a3dba447cb431288b50

If you type the full path of the drive (ie Z:\\ instead of Z:) then you get the current drive contents:

https://preview.redd.it/1y1cvh1be0va1.png?width=600&format=png&auto=webp&v=enabled&s=566fe1896287d2c528a75701692b59ec50f4ea40

I've searched the following locations:

C:\Windows\Prefetch\
%localappdata% …

box computerforensics current data disabled drive explorer files find folders history list microsoft path prefetch run software start system windows windows 10

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

EY GDS Internship Program - SAP, Cyber, IT Consultant or Finance Talents with German language

@ EY | Wrocław, DS, PL, 50-086

Security Architect - 100% Remote (REF1604S)

@ Citizant | Chantilly, VA, United States

Network Security Engineer - Firewall admin (f/m/d)

@ Deutsche Börse | Prague, CZ

Junior Cyber Solutions Consultant

@ Dionach | Glasgow, Scotland, United Kingdom

Senior Software Engineer (Cryptography), Bitkey

@ Block | New York City, United States