File & folder access
OpenSaveMRU and LastVisitedMRU
OpenSavePidlMRU and LastVisitedPidlMRU cheat sheet: ComDlg32 keys per Windows version, what the open/save dialog records, timestamps and upload tips.
- Location
- NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
- Proves
- A user picked a file in an Open/Save dialog, and which program used which folder
- Timestamps
- Subkey LastWrite as FILETIME, UTC, dating only the newest entry of each list; shell items hold DOS date/time of the item itself
- Retention
- Limited entries per list, oldest dropped; cleared with recent items or by cleaners; older versions in hive slack and VSS
- Access
- Per-user NTUSER.DAT, locked while the user is logged on: collect via raw NTFS (KAPE) or VSS; reg export for the current user
- Evidence of
- File & folder accessUser activity
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesUser
- Velociraptor
- Windows.Triage.Targets:RegistryHivesUser
Tools
Compare all toolsWhat it is
Programs that use the Windows common file dialog ("Open", "Save As", "Browse…", and the file picker used by browsers for uploads) let Windows remember the user's recent choices. Those memories live under the ComDlg32 key of the user's NTUSER.DAT: which files were selected, and which folder each application last used. They are strong evidence of deliberate file selection by a user, including files that were uploaded through a web browser.
Location
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\
| Windows version | Subkey | Content |
|---|---|---|
| XP | OpenSaveMRU (+ per-extension subkeys) | Full paths as text |
| XP | LastVisitedMRU | Executable name + folder path as text |
| Vista / 7 / 8 / 10 / 11 | OpenSavePidlMRU\<ext> and OpenSavePidlMRU\* | Selected file as a shell item list (PIDL) |
| Vista / 7 / 8 / 10 / 11 | LastVisitedPidlMRU (and LastVisitedPidlMRULegacy) | Executable name + PIDL of the folder it last used |
| 7 / 8 / 10 / 11 | CIDSizeMRU | Executable names of programs that displayed the dialog |
What it proves
OpenSavePidlMRU: the user selected this file (full path, rebuilt from the PIDL) in an open or save dialog. The*subkey mixes every extension; the others are per extension.LastVisitedPidlMRU: program X last used folder Y in the dialog, for examplechrome.exe→E:\Exfil, a strong pointer to an upload or a download location.CIDSizeMRU: a program showed the dialog at least once, even if nothing was selected.- It does not prove the file was actually read or sent; confirm with browser history, proxy logs or the application's own records.
Key fields
| Element | Meaning |
|---|---|
| Numbered values | PIDL (Vista+) or text path (XP) of one entry |
MRUListEx (MRUList on XP) | Order of use, most recent first |
| LastVisited value data | UTF-16 executable name, then the folder PIDL |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Each subkey LastWrite | An entry is added or moved to the top | FILETIME, UTC | Dates only the most recent entry of that subkey (first in MRUListEx) |
| Times inside shell items | Copied from the file or folder metadata | DOS date/time | Describe the item, not the dialog use |
Retention and clearing
- Each list keeps a limited number of entries and drops the oldest.
- Clearing recent-items history or using privacy cleaners removes the keys; hive slack and shadow copies often keep older versions.
- Portable or custom-dialog applications (some Electron or Java apps) may not use the common dialog and leave no entry.
Collection
- KAPE target:
RegistryHivesUser - Velociraptor (
Windows.Triage.Targets):RegistryHivesUser - Built-in (current user):
reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32" E:\case\comdlg32.reg
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): decodes the PIDLs into paths.
- RegRipper:
comdlg32plugin.
Investigation tips
- For exfiltration via web upload, look for browsers (
chrome.exe,msedge.exe,firefox.exe) inLastVisitedPidlMRUpointing at sensitive or removable-drive folders, and for the uploaded files inOpenSavePidlMRU. - An archive (
.zip,.7z) created in one place and then selected in a browser dialog is a classic sequence: check the.zipsubkey LastWrite against web activity. - Save-dialog entries reveal where a user saved downloaded tools or exported data.
- Correlate folder paths with ShellBags and file names with LNK files and RecentDocs.
Related artifacts
- RecentDocsRecentDocs cheat sheet: NTUSER.DAT key and per-extension subkeys, MRUListEx order, what the LastWrite time means and how to link entries to LNK files.
- ShellBagsShellBags cheat sheet: BagMRU and Bags keys in UsrClass.dat and NTUSER.DAT, shell items, folder timestamps, deleted and USB folders, and parsing with SBECmd.
- LNK shortcut filesLNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
- Browser artifacts (Chrome, Edge, Firefox)Browser forensics cheat sheet: Chromium and Firefox profile files, History and places.sqlite tables, WebKit and PRTime timestamps, downloads, cookies, cache.
- TypedPaths and WordWheelQueryTypedPaths and WordWheelQuery cheat sheet: paths typed in the Explorer address bar and Explorer search terms in NTUSER.DAT, order, timestamps and tips.
Glossary terms
- NTUSER.DATThe per-user registry hive stored in each Windows profile and loaded as HKEY_CURRENT_USER, rich in user activity and persistence traces.
- Shell item (ShellItem / PIDL)A binary structure identifying one element of the Windows Shell namespace, chained into ID lists inside ShellBags, LNK files and Jump Lists.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.