METHOD AND SYSTEM FOR ANALYSING MOST RECENTLY USED REGISTRY KEYS

摘要

A method is disclosed for analysing a computing device including a non-volatile storage medium in which a set of snapshots is stored. Each snapshot comprises at least one most recently used, MRU, key for an application, at least one MRU key having a plurality of elements. The method comprises comparing a first MRU key from a first snapshot for a first time and a corresponding second MRU key for a second snapshot for a second time temporally following said first time. If the second MRU key has a second element identified as less recently used than a first element of the second MRU key and the second element of the first MRU key is identified as not being less recently used than the first element of the first MRU key, the first element is labelled as having been newly modified between the first and second times.