摘要： As important evidences and clue sources in computer crime investigation, the information of user activity plays an important role in the aspect of revealing detail of offender’s operation. The specifc keys of registry in memory are related to specifc us