Word Reading Locations

Where the user stopped in each Word document, and when they last closed it.

Use it to date when a user last closed a Word document and, with File MRU, how long they had it open.

NTUSER.DAT
File and Folder Access

What It Is

Word keeps a note, for each document, of where the reader last stopped and when they last closed it, so it can offer to jump back. That dates when a user last closed a Word document. Set against the File MRU open time, it shows roughly how long the file was open. It is Word only, from Word 2013. It lives in the user's own NTUSER.DAT.

What It Proves

The user had that document open in Word and closed it at the time in Datetime. Set against its File MRU open time, it shows roughly how long the file stayed open.

What It Does Not Prove

Word only, from Word 2013, and files kept in OneDrive may not be listed. Datetime is plain text to the minute, with no time zone marked.

Where It Lives

Word Reading Locations lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Office\<version>\Word\Reading Locations\Document <n>

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Word Reading Locations, each with what it tells you
Registry Value	What It Tells You
`File Path` `REG_SZE:\Clients\Proposal_Draft.docx`	Word kept a reading position for Proposal_Draft.docx on the USB stick that was drive E. Match the path in File MRU to get the time it was opened.
`Datetime` `REG_SZ2026-10-15T17:58`	Word last closed it at 17:58 on 15 Oct 2026, and the subkey time, 16:58 UTC, shows this is BST local time. Put 16:58 UTC on the timeline, not 17:58.
`Document 3` `SubkeyLast write 15 Oct 2026 16:58 UTC`	Word wrote this subkey as it closed the file, at 15 Oct 2026 16:58 UTC. That is seven minutes before the stick left at 17:05, so check what else happened then.

How to Read It

Each Document <n> subkey is one file, with File Path, Datetime and Position values. Datetime reads like 2026-10-15T17:58 with no zone marked, so set it beside the subkey's last write time in UTC to see whether it is local. Match the document's path in Office File MRU to get the time it was opened.

When Windows Writes It: When the user closes a document in Word.
Which Windows Versions: Word 2013 to Microsoft 365 on Windows
Tools That Parse It: Registry Explorer, RECmd

Hunt It

The reading position is kept in this per-user key, so parse the hive, or read it live with Velociraptor. Office File MRU gives the matching open time, so the two together bracket how long the file was open.

Cannot See ItNTUSER.DAT, parsed offline

Defender does not record these values. Collect NTUSER.DAT and parse it.

Parse the Hive Instead

Collect: C:\Users\<user>\NTUSER.DAT
Parse With: Registry ExplorerRECmd

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Word Reading Locations shows.

Office File MRU and Place MRUGives the open time, so with this close time you see how long it was open.
USBSTOR and USB Device KeysDates when the stick was connected and removed, when the document sat on a USB drive.
LNK Files in the Recent FolderNot in the RegistryDates the opening in UTC, a check on Datetime, which carries no time zone.

Sources

The facts on this page come from these public pages, which say more on each point.