Skip to content

Add NirSoft MyLastSearch Module #1118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AndrewRathbun merged 3 commits into from
Sep 15, 2026
Merged

Add NirSoft MyLastSearch Module #1118

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
581317a
Add NirSoft MyLastSearch Module
Gear-I Sep 15, 2026
85a2163
Fixed Documentation to add known limitation
Gear-I Sep 15, 2026
ffd032e
Add newline
AndrewRathbun Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions Modules/Apps/NirSoft/NirSoft_MyLastSearch.mkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
Description: 'NirSoft_MyLastSearch - Nirsoft'
Category: LiveResponse
Author: Dielle De Noon
Version: 1.0
Id: 8ecf4008-2fb2-4c15-8b0f-eb8d1b57be0d
BinaryUrl: https://www.nirsoft.net/utils/mylastsearch.zip
ExportFormat: csv
Processors:
-
Executable: MyLastSearch.exe
CommandLine: /scomma %destinationDirectory%\MyLastSearch.csv
ExportFormat: csv

# Documentation
# https://www.nirsoft.net/utils/my_last_search.html
# MyLastSearch extracts search-engine query terms (Google, Bing, Yahoo, etc.) that a user typed, by scanning browser history/cache files (IE, Firefox, Opera, Chrome). This is a different artifact from visited URLs, which the existing BrowsingHistoryView module already covers.
# LiveResponse only: MyLastSearch's /loadfrom switch is documented to accept explicit history/cache folder paths, which would in theory allow targeting files KAPE has already collected. In testing, /loadfrom consistently produced a 0-byte CSV with no error - both against real KAPE-collected files and against the live system's own real cache/history folders using the exact same paths - across multiple shells (PowerShell and cmd.exe) and argument-passing methods (quoted empty-string placeholders and PowerShell array splatting). Running MyLastSearch with no /loadfrom argument at all (its default behavior, which auto-detects the live/current user's actual browser profiles) reliably produced real, correct results in every test - hundreds of genuine recovered search queries from a live Chrome profile. This module relies on that default live-detection behavior rather than /loadfrom, so it must be run live against the target system rather than against files KAPE has already collected.
# Known limitation: MyLastSearch's CSV export has no header row by default (Search Text, Search Engine, Search Type, Search Time, Web Browser, Hits, URL). To include one, open MyLastSearch.exe's GUI once and enable Options > "Add Header Line To CSV/Tab-Delimited File" - this is a persistent per-user setting rather than a command-line switch, so it also applies to later command-line/KAPE-driven runs once turned on.
Loading