Open
Files picked in Open and Save As windows, and the last folder each program used.
Use it to get the full path of files a user opened or saved in Open and Save As windows, even on a USB stick.
- NTUSER.DAT
- File and Folder Access
What It Is
When a program shows an Open or Save As window, Windows records what the user picked, and this key holds that history. OpenSavePidlMRU keeps the files chosen, grouped by extension, and LastVisitedPidlMRU keeps the last folder each program used. It gives the full path of a file a user opened or saved, even one on a USB stick, which RecentDocs does not. It lives in the user's own NTUSER.DAT.
What It Proves
The user opened or saved a file at that path through a common Open or Save As window. The newest item in each subkey was picked at that subkey's last write time.
What It Does Not Prove
Only files picked through these windows are recorded, not ones opened by double click. Only the newest entry in each key has a time.
Where It Lives
OpenSavePidlMRU and LastVisitedPidlMRU lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice opened or saved E:\ |
| alice opened or saved C:\ |
| WinSCP |
How to Read It
OpenSavePidlMRU has a subkey for each file extension, plus one named * for any file, and each has its own MRUListEx that gives the order, newest first. The values are shell items, so decode them with a tool for the full path, even if the file or USB stick has gone. In LastVisitedPidlMRU each value pairs a program name with the folder it last opened or saved to.
- When Windows Writes It
- Each time the user opens or saves a file through a standard Open or Save As window.
- Which Windows Versions
- Windows Vista to 11 (XP used OpenSaveMRU and LastVisitedMRU)
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (comdlg32)
Hunt It
What a user picked in an Open or Save As window is kept only in this key, so the live tools show the files being written but not the window itself. Velociraptor parses the key from each user's hive.
Reads the DeviceFileEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, which shows saved files being written, not the Open or Save As window. Defender does not read these keys, so collect NTUSER.DAT and parse it for the list itself.
Parse the Hive Instead
- Collect
C:\Users\ <user>\ NTUSER.DAT - Parse With
- Registry ExplorerRECmdRegRipper (comdlg32)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what OpenSavePidlMRU and LastVisitedPidlMRU shows.
- RecentDocsAlso records files opened by double click, with a time for the newest of each type.
- ShellBagsConfirms the user browsed the folders these files sat in.
- LNK Files in the Recent FolderNot in the RegistryDates when each file was first and last opened, where this key times only its newest entry.
Sources
The facts on this page come from these public pages, which say more on each point.