Recent
Files and folders this user opened through Explorer, newest first, grouped by extension.
Use it to see which files and folders a user opened, by name, and date the newest file of each type.
- NTUSER.DAT
- File and Folder Access
What It Is
RecentDocs is the list Explorer keeps of the files and folders a user has opened, so it can offer them again under Recent items. The newest items come first, and there is a subkey for each file extension as well as one for folders. It lives in the user's own NTUSER.DAT, so every item belongs to that user. It records the name a user opened, which is often enough to show intent even without the full path.
What It Proves
The user opened a file or folder with that name. The newest item in each subkey was opened at that subkey's last write time.
What It Does Not Prove
Names only, no full path, and only the newest item in each key has a time. It keeps about 150 items, 20 per extension and 30 folders.
Where It Lives
RecentDocs lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Client_ |
| alice opened Payroll_ |
| Payroll_ |
| alice opened a folder named Clients, but no drive or path is kept. ShellBags show which one it was, the folder on the USB stick that was drive E. |
How to Read It
MRUListEx gives the order, newest first, as four-byte value numbers. Each value holds the name in Unicode followed by a shell item, and there is no full path. Date each subkey's newest item from its last write time, then bracket the rest by their order.
- When Windows Writes It
- When the user opens a file or folder through Explorer or the Windows shell.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (recentdocs)
Hunt It
What a user opened through Explorer is kept only in this key, so the live tools can show the matching files being touched but not the RecentDocs list itself. Velociraptor parses the key from each user's hive.
Recent folder shortcuts appear as files are opened, so this tracks the same activity. It does not read RecentDocs.
// Shortcuts Windows creates in Recent as a user opens filesDeviceFileEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what RecentDocs shows.
- OpenSavePidlMRUGives the full path of files picked in Open and Save windows, which RecentDocs lacks.
- LNK Files in the Recent FolderNot in the RegistryGives each file's full path, and when it was first and last opened.
- Jump ListsNot in the RegistryShows which program opened each file, with full paths and times.
Sources
The facts on this page come from these public pages, which say more on each point.