Office MRU & Trust Records Guide

What it is

Microsoft Office keeps its own per-user lists of recently opened files and folders, separate from Explorer's RecentDocs. Unlike most MRU lists, each Office entry carries its own timestamp. Office also records, under Trust Records, the documents for which a user clicked "Enable Editing" or "Enable Content": the classic first step of a macro-based infection.

Location

All under NTUSER.DAT\Software\Microsoft\Office\<version>\, where <version> is 12.0 (2007), 14.0 (2010), 15.0 (2013) or 16.0 (2016, 2019, 2021, Microsoft 365) and <App> is Word, Excel, PowerPoint, Access…

Key	Content
`<App>\File MRU`	Recent files (local accounts / older versions)
`<App>\Place MRU`	Recent folders
`<App>\User MRU\<account id>\File MRU` and `\Place MRU`	Same lists per signed-in account (Microsoft 365; ids such as `LiveId_…` or `ADAL_…`)
`<App>\Security\Trusted Documents\TrustRecords`	Documents trusted by the user (editing and/or macros enabled)

What it proves

File MRU: the user opened the document in that Office application, with a timestamp per entry, and its full path (local, removable or network).
Place MRU: folders used from inside Office.
TrustRecords: the user enabled editing (left Protected View) and, depending on the data, enabled macros for that document.
Office account subkeys tie activity to a Microsoft 365 or Entra ID identity.

Key fields

Element	Meaning
`Item N` value (File/Place MRU)	String such as `[F00000000][T01D9…][O00000000]*C:\Users\bob\Desktop\invoice.docm`
`[T…]`	64-bit FILETIME written in hexadecimal
Path after `*`	Full path of the document or folder
TrustRecords value name	Full path (or URL) of the trusted document
TrustRecords data, first 8 bytes	FILETIME of when the document was trusted
TrustRecords data, last 4 bytes	`FF FF FF 7F` when macros were enabled ("Enable Content")

Timestamps

Timestamp	Set when	Format	Pitfalls
`[T…]` in File MRU	Document opened in that application	Hex FILETIME, UTC	Commonly read as the last open time; confirm with LNK files and Jump Lists
TrustRecords first 8 bytes	User clicked Enable Editing / Enable Content	FILETIME, UTC	A later enable action can update the record
Key LastWrite	Any entry changed	FILETIME, UTC	Only the most recent change

Retention and clearing

The MRU lists keep a limited number of items per application (configurable in Office options) and drop the oldest.
Removing an item from the Office "Recent" list deletes its value; TrustRecords persist until trust is reset or the key is deleted.
Renamed or moved documents keep their old path in the MRU, which helps trace originals.

Collection

KAPE target: RegistryHivesUser
Velociraptor (Windows.Triage.Targets): RegistryHivesUser; Windows.Registry.EnabledMacro lists TrustRecords with macros enabled.
Built-in (current user):

reg query "HKCU\Software\Microsoft\Office\16.0\Word" /s /f "MRU"
reg query "HKCU\Software\Microsoft\Office\16.0\Word\Security\Trusted Documents\TrustRecords"

Parsing tools

Registry Explorer / RECmd (Eric Zimmerman): Office MRU and TrustRecords plugins decode paths and timestamps.
RegRipper: officedocs2010 and trustrecords plugins.
Velociraptor: Windows.Registry.EnabledMacro.

Investigation tips

In phishing cases, a TrustRecords entry ending in FF FF FF 7F for a file in Downloads or Content.Outlook is often the moment of compromise; line it up with the first suspicious process.
Check the document's Zone.Identifier to confirm it came from the Internet (Mark of the Web).
Paths on USB drives or shares in File MRU show which documents a user opened from external media.
Compare Office MRU times with RecentDocs, which has no per-entry time.

Office MRU and Trust Records

Tools