From 581317a1a365f71eb15ce4bcc5ca8c2a01480927 Mon Sep 17 00:00:00 2001 From: Gear-I Date: Tue, 15 Sep 2026 15:58:31 -0400 Subject: [PATCH 1/3] Add NirSoft MyLastSearch Module --- .../Apps/NirSoft/NirSoft_MyLastSearch.mkape | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape diff --git a/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape b/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape new file mode 100644 index 000000000..dba484752 --- /dev/null +++ b/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape @@ -0,0 +1,22 @@ +Description: 'NirSoft_MyLastSearch - Nirsoft' +Category: LiveResponse +Author: Dielle De Noon +Version: 1.0 +Id: 8ecf4008-2fb2-4c15-8b0f-eb8d1b57be0d +BinaryUrl: https://www.nirsoft.net/utils/mylastsearch.zip +ExportFormat: csv +Processors: + - + Executable: MyLastSearch.exe + CommandLine: /scomma %destinationDirectory%\MyLastSearch.csv + ExportFormat: csv + +# Documentation +# https://www.nirsoft.net/utils/my_last_search.html +# MyLastSearch extracts search-engine query terms (Google, Bing, Yahoo, etc.) that a user typed, by scanning browser history/cache files. This is a different artifact from visited URLs, which the existing BrowsingHistoryView module already covers. +# Requires --mvars username: at runtime so %username% resolves to the actual collected user folder name under %sourceDirectory%\Users\ - KAPE's %user% wildcard is a Target-only feature and is not available inside a Module command line. +# Known limitations, verified directly against NirSoft's own documentation (the /loadfrom switch takes exact literal paths, no wildcard support): +# - Firefox/Mozilla: omitted (empty string) in this command line. Firefox profile folders include a randomized suffix (e.g. xxxxxxxx.default-release) that can't be hardcoded generically across installs. +# - Opera: omitted (empty string) in this command line since it could not be tested on the authoring machine (no Opera install available to verify against). If you have Opera, its cache folder is conventionally at "...\AppData\Local\Opera Software\Opera Stable\Cache" - add that path to the corresponding /loadfrom slot yourself if needed. +# - IE Cache: included as a best-effort path (the modern INetCache folder), but MyLastSearch is built for the legacy History.IE5/Content.IE5 index.dat format. On a modern Windows 10/11 system INetCache no longer stores data in a format MyLastSearch reads, so this slot is expected to return nothing - confirmed empty during testing. +# - Chrome: assumes the "Default" profile folder. Will not surface search terms from additional/secondary Chrome profiles on multi-profile setups. From 85a216363d8260fd157f887f723b409c9f2d4226 Mon Sep 17 00:00:00 2001 From: Gear-I Date: Tue, 15 Sep 2026 16:04:46 -0400 Subject: [PATCH 2/3] Fixed Documentation to add known limitation --- Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape b/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape index dba484752..6a7c87e0d 100644 --- a/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape +++ b/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape @@ -13,10 +13,6 @@ Processors: # Documentation # https://www.nirsoft.net/utils/my_last_search.html -# MyLastSearch extracts search-engine query terms (Google, Bing, Yahoo, etc.) that a user typed, by scanning browser history/cache files. This is a different artifact from visited URLs, which the existing BrowsingHistoryView module already covers. -# Requires --mvars username: at runtime so %username% resolves to the actual collected user folder name under %sourceDirectory%\Users\ - KAPE's %user% wildcard is a Target-only feature and is not available inside a Module command line. -# Known limitations, verified directly against NirSoft's own documentation (the /loadfrom switch takes exact literal paths, no wildcard support): -# - Firefox/Mozilla: omitted (empty string) in this command line. Firefox profile folders include a randomized suffix (e.g. xxxxxxxx.default-release) that can't be hardcoded generically across installs. -# - Opera: omitted (empty string) in this command line since it could not be tested on the authoring machine (no Opera install available to verify against). If you have Opera, its cache folder is conventionally at "...\AppData\Local\Opera Software\Opera Stable\Cache" - add that path to the corresponding /loadfrom slot yourself if needed. -# - IE Cache: included as a best-effort path (the modern INetCache folder), but MyLastSearch is built for the legacy History.IE5/Content.IE5 index.dat format. On a modern Windows 10/11 system INetCache no longer stores data in a format MyLastSearch reads, so this slot is expected to return nothing - confirmed empty during testing. -# - Chrome: assumes the "Default" profile folder. Will not surface search terms from additional/secondary Chrome profiles on multi-profile setups. +# MyLastSearch extracts search-engine query terms (Google, Bing, Yahoo, etc.) that a user typed, by scanning browser history/cache files (IE, Firefox, Opera, Chrome). This is a different artifact from visited URLs, which the existing BrowsingHistoryView module already covers. +# LiveResponse only: MyLastSearch's /loadfrom switch is documented to accept explicit history/cache folder paths, which would in theory allow targeting files KAPE has already collected. In testing, /loadfrom consistently produced a 0-byte CSV with no error - both against real KAPE-collected files and against the live system's own real cache/history folders using the exact same paths - across multiple shells (PowerShell and cmd.exe) and argument-passing methods (quoted empty-string placeholders and PowerShell array splatting). Running MyLastSearch with no /loadfrom argument at all (its default behavior, which auto-detects the live/current user's actual browser profiles) reliably produced real, correct results in every test - hundreds of genuine recovered search queries from a live Chrome profile. This module relies on that default live-detection behavior rather than /loadfrom, so it must be run live against the target system rather than against files KAPE has already collected. +# Known limitation: MyLastSearch's CSV export has no header row by default (Search Text, Search Engine, Search Type, Search Time, Web Browser, Hits, URL). To include one, open MyLastSearch.exe's GUI once and enable Options > "Add Header Line To CSV/Tab-Delimited File" - this is a persistent per-user setting rather than a command-line switch, so it also applies to later command-line/KAPE-driven runs once turned on. \ No newline at end of file From ffd032e80ae7c0438be3bd162e71260b4bbd1329 Mon Sep 17 00:00:00 2001 From: Andrew Rathbun <36825567+AndrewRathbun@users.noreply.github.com> Date: Tue, 15 Sep 2026 16:33:49 -0400 Subject: [PATCH 3/3] Add newline --- Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape b/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape index 6a7c87e0d..018a269b3 100644 --- a/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape +++ b/Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape @@ -15,4 +15,4 @@ Processors: # https://www.nirsoft.net/utils/my_last_search.html # MyLastSearch extracts search-engine query terms (Google, Bing, Yahoo, etc.) that a user typed, by scanning browser history/cache files (IE, Firefox, Opera, Chrome). This is a different artifact from visited URLs, which the existing BrowsingHistoryView module already covers. # LiveResponse only: MyLastSearch's /loadfrom switch is documented to accept explicit history/cache folder paths, which would in theory allow targeting files KAPE has already collected. In testing, /loadfrom consistently produced a 0-byte CSV with no error - both against real KAPE-collected files and against the live system's own real cache/history folders using the exact same paths - across multiple shells (PowerShell and cmd.exe) and argument-passing methods (quoted empty-string placeholders and PowerShell array splatting). Running MyLastSearch with no /loadfrom argument at all (its default behavior, which auto-detects the live/current user's actual browser profiles) reliably produced real, correct results in every test - hundreds of genuine recovered search queries from a live Chrome profile. This module relies on that default live-detection behavior rather than /loadfrom, so it must be run live against the target system rather than against files KAPE has already collected. -# Known limitation: MyLastSearch's CSV export has no header row by default (Search Text, Search Engine, Search Type, Search Time, Web Browser, Hits, URL). To include one, open MyLastSearch.exe's GUI once and enable Options > "Add Header Line To CSV/Tab-Delimited File" - this is a persistent per-user setting rather than a command-line switch, so it also applies to later command-line/KAPE-driven runs once turned on. \ No newline at end of file +# Known limitation: MyLastSearch's CSV export has no header row by default (Search Text, Search Engine, Search Type, Search Time, Web Browser, Hits, URL). To include one, open MyLastSearch.exe's GUI once and enable Options > "Add Header Line To CSV/Tab-Delimited File" - this is a persistent per-user setting rather than a command-line switch, so it also applies to later command-line/KAPE-driven runs once turned on.