TypedPaths

Overview

Evidence: TypedPaths Description: Enumerate TypedPaths Category: System Platform: windows Short Name: typedpaths Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Windows Explorer maintains a history of paths that users manually type into the Explorer address bar. This registry artifact tracks folder navigation through typing rather than clicking, providing evidence of deliberate user navigation to specific locations.

This can reveal user knowledge of specific file locations, hidden folders, network shares, and administrative directories.

Data Collected

This collector gathers structured data about typedpaths.

TypedPaths Data

Field	Description	Example
Value	Registry value name	url1
Path	Typed path	C:\Users\user\AppData\Local\Temp\suspicious
Username	User account name	user
KeyPath	Registry key path	Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
LastWriteTime	Registry key last write time	2023-10-15T14:30:00
RegPath	Path to registry hive	Registry/ntuser.dat

Collection Method

This collector:

• Collects user registry hives (ntuser.dat)

• Searches for: Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

• Enumerates all values under the key

• Extracts the typed path strings

• Records registry key last write time

Forensic Value

Typed paths reveal deliberate user navigation and knowledge of specific locations. Investigators use this data to prove user knowledge of hidden folders, identify access to suspicious directories, track network share navigation, detect attempts to access admin folders, establish intent through manual navigation, and identify typed paths to malware locations.