Office File MRU and Place MRU
Files opened in Word, Excel and PowerPoint, each with its full path and its own time.
Use it to get the full path and last open time of files a user opened in Word, Excel or PowerPoint, even on a USB stick.
- NTUSER.DAT
- File and Folder Access
What It Is
Word, Excel and PowerPoint each keep a most recently used list of the files a user has opened, and each entry holds the file's full path and its own open time. A companion Place MRU lists the folders those files came from. The file list gives the full path and last open time of a file a user opened, even one on a USB stick, which plain Recent lists lack. It lives in the user's own NTUSER.DAT, under the Office version number.
What It Proves
The user opened that file in that Office app, last at the time stored in its own entry. Place MRU lists the folders those files came from.
What It Does Not Prove
It records opening, not editing or saving, and only Office apps write it. Microsoft 365 keeps a list per signed-in account, so File MRU on its own can miss most of it.
Where It Lives
Office File MRU and Place MRU lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Excel last opened Client_ |
| Excel opened Budget_ |
| Word opened Proposal_ |
| The newest folder Excel used was E:\ |
How to Read It
Item 1 is the newest, and each value reads [F...][T...][O...]*<full path>. The 16 hexadecimal digits after T are a FILETIME written most significant byte first, so decode them as UTC. In Microsoft 365, look under User MRU\LiveId_<id> for a personal account and User MRU\ADAL_<id> for a work account. Place MRU, beside File MRU, lists folders and can keep ones that have dropped out of File MRU.
- When Windows Writes It
- Each time the user opens a file in that Office app.
- Which Windows Versions
- Office 2010 to Microsoft 365 on Windows keep it. Version 16.0 covers Office 2016 and later.
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
What a user opened in Office is kept in this per-user key, so parse the hive, or read it live with Velociraptor. A file opened from a share can also leave a record in the server's Security log, when the server audits file shares.
Shows documents passed to Office when a double click starts it. Files opened inside an app that is already running leave no process event, so File MRU stays the fuller record.
// Office apps started with a document on the command line: double-clicked filesDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Office File MRU and Place MRU shows.
- Word Reading LocationsGives when the user closed the document, so how long it stayed open.
- Office Trusted Documents (TrustRecords)Shows the user enabled editing or macros in the file, not just opened it.
- LNK Files in the Recent FolderNot in the RegistryConfirms the file was opened, with first and last open times kept outside Office.
Sources
The facts on this page come from these public pages, which say more on each point.