TaskBar FeatureUsage: Tracking executed Applications

So let's talk about something that doesn't get nearly enough attention in the digital forensics world — the FeatureUsage registry key. If you're investigating Windows systems and you're not checking this, you're genuinely leaving evidence on the table.

------------------------------------------------------------------------------------------------------------

Okay, But What Even Is FeatureUsage?

FeatureUsage showed up in Windows 10 build 1903 and was first publicly reported by researcher Jai Minton.

At its core, it's Windows quietly keeping tabs on how users interact with the taskbar and GUI applications — things like which apps were launched, how often they were in focus, how many notifications popped up, and even how many times someone right-clicked an icon.

Now here's the part that makes investigators happy: this data doesn't disappear when an app gets uninstalled. That means if someone ran a VPN client, a privacy cleaner, or some sketchy chat app and then deleted it trying to cover their tracks? FeatureUsage still has the receipts.

You'll find it sitting in the user's NTUSER.DAT file at:

Since it's tied to individual user profiles, every user on the machine has their own copy of this data.

------------------------------------------------------------------------------------------------------------

The Subkeys You Actually Care About

1. AppLaunch — "What Was Pinned and How Often Was It Clicked?"

This one only tracks apps that were pinned to the taskbar — which is already telling you something useful.

If an app is pinned, the user knew about it, used it enough to want it front and center, and actively kept it there. That's not an accident.

Each pinned application shows up as a value, and the data field tells you exactly how many times that pinned shortcut was clicked to launch the app. Even if the user later unpinned it, the record stays.

And because , you typically get the full file path — which is great for spotting apps running out of weird locations like temp folders or random AppData subdirectories.

Malware loves hiding in unusual spots, and this key can expose that.

2. AppSwitched — "Which Apps Were Actually Being Used?"

While AppLaunch only covers pinned apps, AppSwitched casts a much wider net. 

This one tracks how many times any application became the active window — meaning keyboard input, mouse focus, the whole thing was directed at it.

It even catches the original installer apps (think setup wizards), since those are GUI-based and require user focus to get through. In practice, you'll often see something like a browser absolutely dominating the count, which makes sense.

3. AppBadgeUpdated — "How Many Notifications Did They Get?"

This one tracks the notification badges that appear on taskbar icons — you know, like when your Slack icon shows "11 new messages."

AppBadgeUpdated counts how many of those accumulated for each app.

4. ShowJumpView — "Did They Right-Click and Dig Deeper?"

When a user right-clicks a taskbar icon, they get a Jump List — quick access to recent files, saved sessions, frequent actions, etc.

ShowJumpView counts how many times that happened per application.

Here's a practical example:

if Remote Desktop Connection shows 4 right-clicks in ShowJumpView, that strongly suggests the user was accessing saved RDP connections from the Jump List. Combine that with Jump List forensics and you've got a much richer picture of where they were connecting.

5. TrayButtonClicked — The One People Always Forget

This is the subkey that covers everything else on the taskbar — the clock, the Start button, the search box, Cortana, system tray widgets, all of it. And it's surprisingly powerful.

Think about what the search box alone can tell you. If someone was running searches on a system, TrayButtonClicked will reflect that activity.

Now imagine you're looking at a profile created during an attacker's RDP session — and you can see they were hammering the search functionality. That's a huge behavioral clue about what they were looking for on the machine.

------------------------------------------------------------------------------------------------------------

Why This Changes the Investigation?

The thing that makes FeatureUsage genuinely powerful isn't any one subkey in isolation — it's the combination.

You've got execution evidence even for uninstalled apps, focus and interaction evidence for everything GUI, passive engagement evidence even when apps weren't actively opened, deep interaction evidence through Jump List usage, and taskbar behavior evidence covering searches, clock use, and more.

None of this gets wiped when someone uninstalls software and tries to clean up. That's a big deal.

------------------------------------------------------------------------------------------------------------

How to Use It Properly

Cross-reference everything :- AppSwitched data hits different when you line it up against UserAssist and Prefetch. If all three are pointing at the same application, that's a strong execution timeline.

Pay attention to deleted apps :- If AppLaunch shows a high execution count for a path that no longer exists on the system, something was there and it was used regularly before being removed.

Sort by count :- High focus counts in AppSwitched = high user interaction. Start with the outliers.

Watch for behavioral anomalies. A user who "never touches Jump Lists" but has 50+ right-clicks on a VPN shortcut? That tells a story.

------------------------------------------------------------------------------------------------------------

Bottom Line

• FeatureUsage tracks application usage at a granular level and survives uninstallations

• Use AppSwitched to counter "I never used that program" claims with hard numbers

• Use AppLaunch to find evidence of deleted or hidden applications

• Don't sleep on TrayButtonClicked — especially on attacker RDP profiles

• Always pair with Prefetch, BAM/DAM, and UserAssist for a full timeline

---------------------------------------------Dean-----------------------------------------------------------