TypedPaths & WordWheelQuery Guide

What it is

Two small per-user lists written by Windows Explorer:

TypedPaths: paths the user typed or pasted into the Explorer address bar (for example \\fileserver\finance$ or C:\Windows\Temp).
WordWheelQuery: terms the user searched for in the Explorer search box (for example password, *.kdbx, invoice).

Both reveal intent in the user's own words, which makes them valuable in insider and data-theft cases.

Location

Windows version	Key (NTUSER.DAT)	Content
Vista / 7 / 8 / 10 / 11	`Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`	Values `url1` … `urlN` (text), `url1` = most recent
7 / 8 / 10 / 11	`Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery`	Numbered values (UTF-16 terms) + `MRUListEx`
XP	`Software\Microsoft\Search Assistant\ACMru\<id>`	Search Companion history (file names, words searched)

The Windows 10/11 taskbar and Start search do not write their terms to WordWheelQuery; only the Explorer window search box does.

What it proves

TypedPaths: the user deliberately entered a location, including hidden admin shares, UNC paths to other hosts and folders not reachable by clicking.
WordWheelQuery: the user looked for something by name, even if nothing was found or no file was opened afterwards.
Neither proves that the location was reachable or that a result was opened; pair with ShellBags and LNK files.

Key fields

Element	Meaning
`url1` … `urlN` (TypedPaths)	Typed paths, `url1` newest
Numbered values (WordWheelQuery)	Search terms, UTF-16, null-terminated
`MRUListEx` (WordWheelQuery)	Order of searches, most recent first

Timestamps

Timestamp	Set when	Format	Pitfalls
TypedPaths key LastWrite	A path is typed	FILETIME, UTC	Dates `url1` only
WordWheelQuery key LastWrite	A search term is added or reused	FILETIME, UTC	Dates the first entry of `MRUListEx` only

Retention and clearing

TypedPaths keeps a short list (the oldest url values drop off); WordWheelQuery keeps a limited MRU list.
"Clear history" in the Explorer address bar or search options and privacy cleaners delete these values; check hive slack and shadow copies.

Collection

KAPE target: RegistryHivesUser
Velociraptor (Windows.Triage.Targets): RegistryHivesUser
Built-in (current user):

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery"

Parsing tools

Registry Explorer / RECmd (Eric Zimmerman): decodes WordWheelQuery binary values and MRU order.
RegRipper: typedpaths and wordwheelquery plugins.

Investigation tips

Typed UNC paths to other machines (\\SRV01\C$) are a sign of manual lateral movement or data browsing; check the target host's logon events.
Search terms such as password, vpn, confidential, *.pst or a competitor's name are strong intent indicators in insider cases.
Combine the TypedPaths LastWrite with RunMRU and ShellBags to rebuild the session minute by minute.
For indexed content the user may have found, see the Windows Search index.

TypedPaths and WordWheelQuery

Tools