key that we're looking at here. We're actually going to drill down into a somewhat familiar location, or at least I think it will be familiar to you. And that's going to be under Microsoft Windows current version explorer. And this is the familiar part because within this specific path, we have quite a few very common registry based artifacts that we leverage. But we're going to drill down even deeper. And under explore, we're going to go to feature usage. And here is where we're going to find app switched. Now, you'll notice that we also have app badge updated, app launch, and show jump view. In this episode, we're only going to be focused on app switched, though those other keys may also contain some useful information. So, what exactly does app switched track? Well, it increments a counter each time a user leftclicks an application on the taskbar to switch focus to it. The key behaves somewhat like user assist and recent apps in the sense that it can demonstrate per user guey based application execution but with an important distinction. Instead of showing launches, app switched reflects the number of times a user switched back to an app via leftclicking on it. This makes it useful as an evidence of execution artifact but also as an indicator of interactive user behavior. It shows deliberate engagement with an application, not just a process starting in the background. Now, let's take a look at what we have here. You'll notice we can see regedit, Arsenal image mounter, timeline explorer, registry explorer, and if we look through here, we'll see some apps like notepad. Now, notice that all of the values are of type regge dword. And again, the value that you see here, for example, is 81, which as I said, reflects the number of times the user has leftclicked an application on the taskbar to switch focus to it. Now, notice that number is 81. Let's test something. We'll go ahead and bring up Notepad. And what I'm going to do is just use Alt Tab to switch back to Reedit. And then I'm going to use Alt Tab again to switch back to Notepad. And then once more back to Regedit. Now, what we'll do is go up to view and refresh. And notice that it still says 81. This time though, let's leftclick on the notepad icon on the taskbar. So now we've switched to it by that means. And if we switch back to regedit and then go over to view and refresh, notice that the counter is now incremented to 82. So it didn't increment when we used alt tab, but it did when we leftclicked the icon on the taskbar. That's an important distinction, but regardless, it does show that this particular user had some sort of interaction with this application, not just something that ran in the background. Now, it's also worth clarifying what app switched does not provide. The individual values, as you can clearly see, do not contain timestamps. And as you can also see, there's no MRU list here. That means that you can't determine which entry in this list was used last or in what order they were created or updated. In fact, the only temporal information you'll have available is the last write timestamp of the apt switch sub key itself. Now, of course, in regedit, we're not able to see that value. But if we navigated to this same path within Eric Zimmerman's registry explorer and went to app switched, we could easily obtain the last right timestamp. That time stamp is going to tell us that any activity reflected in this key must have occurred on or before that time, but nothing more specific than that. Still, that can be useful when reconstructing timelines, especially when other artifacts have rolled over or have been cleared. Now, from a forensics perspective, app switched can help fill in gaps when traditional execution artifacts are missing or incomplete, possibly even deliberately removed, as in anti-forensics. And that's because it tracks those focused application switches. So this is going to offer a window into what the user was actively engaged with, not just what executed passively. And because it's tied to a specific user hive, it helps attribute that activity to a specific user account. So the next time you're working on a case and you need just one more piece of context about what a user was really doing, app switched might just give you enough information to fill in yet another piece of the puzzle. So, that's a quick look at the app switched registry key. I hope you found this information useful and as always, thanks for watching, thanks for subscribing, and I'll see you in the next 13 cubed episode.
