WordWheelQuery

Words this user searched for in the File Explorer search box, newest first.

Use it to read the words a user searched for in File Explorer, a direct view of what they were looking for.

NTUSER.DAT
File and Folder Access

What It Is

WordWheelQuery is the list Explorer keeps of the terms a user has typed into the File Explorer search box, newest first. That makes it a direct view of what a user was looking for on the machine. Only the newest term has a time, from the key's last write. It lives in the user's own NTUSER.DAT.

What It Proves

The user searched File Explorer for that term, which shows what they were looking for. The newest search ran at the key last write time.

What It Does Not Prove

Only the newest term has a time. On Windows 10 and 11, searches typed into the Start menu or taskbar are not kept here.

Where It Lives

WordWheelQuery lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in WordWheelQuery, each with what it tells you
Registry Value	What It Tells You
`2` `REG_BINARY70 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00`	alice searched File Explorer for password at the key time, 15 Oct 2026 16:12 UTC. It may be a hunt for stored passwords, and RecentDocs shows what she opened next.
`1` `REG_BINARY70 00 61 00 79 00 72 00 6F 00 6C 00 6C 00 00 00`	Before that she searched for payroll, with no time of its own. RecentDocs dates Payroll_Q3.pdf to 16:36 UTC, so check whether the search found it.
`0` `REG_BINARY63 00 6C 00 69 00 65 00 6E 00 74 00 00 00`	Her oldest kept search was client, with no time of its own. With password and payroll it shows what she was after, so compare it with E:\Clients.

How to Read It

Each numbered value holds one search term as Unicode text. MRUListEx gives the order, newest first, as 4-byte value numbers. The key last write time belongs to the first entry in MRUListEx.

When Windows Writes It: Each time the user runs a search in File Explorer.
Which Windows Versions: Windows 7 to 11
Tools That Parse It: Registry Explorer, RECmd, RegRipper (wordwheelquery)

Hunt It

What a user searched for is kept only in this per-user key, so parse the hive, or read it live with Velociraptor. What they opened next is in RecentDocs and LNK files.

Cannot See ItNTUSER.DAT, parsed offline

Defender does not record Explorer searches. Collect NTUSER.DAT and parse it.

Parse the Hive Instead

Collect: C:\Users\<user>\NTUSER.DAT
Parse With: Registry ExplorerRECmdRegRipper (wordwheelquery)

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what WordWheelQuery shows.

RecentDocsLists the files the user opened, which may be what the search was for.
LNK Files for the Files Opened After the SearchNot in the RegistryShows what the user opened after searching, with full paths and times.

Sources

The facts on this page come from these public pages, which say more on each point.