File & folder access
RecentDocs
RecentDocs cheat sheet: NTUSER.DAT key and per-extension subkeys, MRUListEx order, what the LastWrite time means and how to link entries to LNK files.
- Location
- NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
- Proves
- A user recently opened files and folders with these names, in this order
- Timestamps
- Key and extension subkey LastWrite as FILETIME, UTC, dating only the newest entry of each list; other entries undated
- Retention
- Limited entries per key, oldest dropped; cleared with recent items, by GPO or cleaners; deleted values survive in hive slack and VSS
- Access
- Per-user NTUSER.DAT, locked while the user is logged on: collect via raw NTFS (KAPE) or VSS; reg query for the current user
- Evidence of
- File & folder accessUser activity
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesUser
- Velociraptor
- Windows.Triage.Targets:RegistryHivesUser
Tools
Compare all toolsWhat it is
RecentDocs is the per-user "most recently used" list behind Explorer's recent items. Whenever a user opens a file or folder through the shell, Windows adds its name to this key, both in a global list and in a subkey for the file extension. It complements the .lnk files of the Recent folder and often keeps entries whose shortcut has been deleted.
Location
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
| Key | Content |
|---|---|
RecentDocs (root) | All recent items, any type |
RecentDocs\.<ext> (for example .docx, .pdf, .zip) | Recent items with that extension |
RecentDocs\Folder | Recently opened folders |
The same layout exists from Windows XP to Windows 11.
What it proves
- The user whose NTUSER.DAT holds the key opened items with these names, and the order in which they were last opened.
- The time the most recent item of each key was opened (key LastWrite, see below).
- Extension subkeys quickly show which kinds of files the user handled (archives, scripts, disk images).
- It does not store the full path; recover it from the matching LNK file or Jump List.
Key fields
| Element | Meaning |
|---|---|
Numbered values (0, 1, 2…) | Binary data: UTF-16 item name, then the name of the matching shortcut and a shell item |
MRUListEx | List of value numbers, most recently opened first |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Key LastWrite | An item is added or moved to the top of that key's list | FILETIME, UTC | Applies only to the first entry of MRUListEx in that key |
| Extension subkey LastWrite | Same, for that extension | FILETIME, UTC | Gives one more dated item per extension: the most recent .pdf, the most recent .zip… |
Other entries have no time of their own; date them with LNK files, Jump Lists or the file system.
Retention and clearing
- Each key keeps a limited number of entries; the oldest are dropped as new items are opened.
- Clearing "recent items" in Explorer, the Group Policy "Do not keep history of recently opened documents" or privacy cleaners remove or stop the list.
- Deleted values can survive in hive slack and in shadow-copy versions of NTUSER.DAT.
Collection
- KAPE target:
RegistryHivesUser - Velociraptor (
Windows.Triage.Targets):RegistryHivesUser;Windows.Registry.RecentDocsparses it live. - Built-in (current user):
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /s
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): decodes names and
MRUListExorder. - RegRipper:
recentdocsplugin. - Velociraptor:
Windows.Registry.RecentDocs.
Investigation tips
- Read the extension subkeys first: a
.7z,.raror.zipentry opened just before a USB drive was connected is a common exfiltration pattern. - Pair each name with its LNK file in
Recentto get the full path, the volume serial number and timestamps. - Use the
Foldersubkey with ShellBags to rebuild the browsing path. - Office documents also appear in the application's own list (Office MRU), which carries per-entry timestamps.
Related artifacts
- LNK shortcut filesLNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
- Jump ListsJump Lists cheat sheet: AutomaticDestinations and CustomDestinations, AppIDs, DestList entries with last access, access count and pin status, and JLECmd.
- OpenSaveMRU and LastVisitedMRUOpenSavePidlMRU and LastVisitedPidlMRU cheat sheet: ComDlg32 keys per Windows version, what the open/save dialog records, timestamps and upload tips.
- Office MRU and Trust RecordsOffice MRU and TrustRecords cheat sheet: File MRU and User MRU keys per Office version, the [T…] timestamp, and how to spot documents with macros enabled.
- ShellBagsShellBags cheat sheet: BagMRU and Bags keys in UsrClass.dat and NTUSER.DAT, shell items, folder timestamps, deleted and USB folders, and parsing with SBECmd.
Glossary terms
- NTUSER.DATThe per-user registry hive stored in each Windows profile and loaded as HKEY_CURRENT_USER, rich in user activity and persistence traces.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.
- Shell item (ShellItem / PIDL)A binary structure identifying one element of the Windows Shell namespace, chained into ID lists inside ShellBags, LNK files and Jump Lists.