TypedPaths

Paths this user typed or pasted into the File Explorer address bar, newest first.

Use it to show a user knew a location, such as an admin share or a folder on a USB stick, because they typed its path.

NTUSER.DAT
File and Folder Access

What It Is

TypedPaths is the short list Explorer keeps of the paths a user typed or pasted into the address bar, newest first. A typed path shows the user knew the location, because they typed it rather than clicking to it. That is telling for an admin share, a hidden folder or a USB drive. It holds no list order beyond url1 being newest. It lives in the user's own NTUSER.DAT.

What It Proves

The user typed or pasted that path into the address bar, so they knew the location, whether a share, a hidden folder or a USB drive.

What It Does Not Prove

There is no MRU list, and the only time is the key last write, which Explorer sets as its window closes, not when url1 was typed. Folders reached by clicking are not recorded.

Where It Lives

TypedPaths lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in TypedPaths, each with what it tells you
Registry Value	What It Tells You
`url1` `REG_SZE:\Clients`	alice entered E:\Clients on the USB stick, and that window closed at the key time, 15 Oct 2026 17:04 UTC. She knew the path, so check LNK files for what she opened.
`url2` `REG_SZ\\srv-fin-01\c$`	Earlier she entered the C$ admin share on srv-fin-01, with no time of its own here. MountPoints2 dates her last visit to 14 Oct 2026 22:19 UTC.
`url3` `REG_SZC:\Users\alice\AppData\Roaming`	She also entered her hidden AppData\Roaming folder, where odupd.exe sits. Hidden folders are not found by chance, so check Amcache for when odupd.exe arrived.

How to Read It

Values url1, url2 and so on hold the paths, and url1 is the newest. Date only url1, and only roughly, because the key's last write time marks when that Explorer window closed. Look for UNC paths, admin shares such as c$, removable drive letters and hidden folders.

When Windows Writes It: When an Explorer window closes after the user typed or pasted a path into its address bar.
Which Windows Versions: Windows 7 to 11
Tools That Parse It: Registry Explorer, RECmd, RegRipper (typedpaths)

Hunt It

What a user typed into the address bar is kept only in this per-user key, so parse the hive, or read it live with Velociraptor. Where a typed path was a share or a drive, MountPoints2 and the USB keys can date the visit.

Cannot See ItNTUSER.DAT, parsed offline

Defender does not record typed paths. For a UNC path, SMB connections on port 445 in DeviceNetworkEvents show the server was reached.

Parse the Hive Instead

Collect: C:\Users\<user>\NTUSER.DAT
Parse With: Registry ExplorerRECmdRegRipper (typedpaths)

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what TypedPaths shows.

ShellBagsConfirms the user browsed to the path they typed, and roughly when.
MountPoints2Shows the share or volume behind the typed path was mounted for this user.
LNK Files and Jump ListsNot in the RegistryShows which files the user opened there, with times of their own.

Sources

The facts on this page come from these public pages, which say more on each point.