Forensic journey: Breaking down the UserAssist artifact structure

This report presents an in-depth forensic analysis of the Windows UserAssist artifact, explaining how shell32.dll logs GUI/CLI program executions, focus events, and durations, and why records often appear inconsistent. It reverse-engineers CUASession and the UEME_CTLSESSION value (including NMax “top usage” entries), documents the per-program binary structure with the newly identified r0 usage-percentage history and session reset logic, and provides practical insights for incident response along with a parser to extract these data points.