The script uses Willi Ballenthin's python-registry project" rel="nofollow" target="_blank">https://github.com/williballenthin/python-registry">python-registry project (install through pip: pip install python-registry ). It will output the list of filenames in order with the associated timestamps. Usage is simple. Only the -f option is required to specify the NTUSER.dat file of interest. If no other option is used, output will be to the console. If the -o option is used, the output will be written to the file specified.