mru.acmru
#
$ target-query <path/to/target> -f mru.acmru
Module |
|
Output |
|
Module documentation
Return MRU data stored at various registry keys.
The Windows registry contains various keys about Most Recently Used (MRU) files.
- References:
Function documentation
Return the ACMru (Windows Search) data.
- The following keys are being searched:
HKCU\Software\Microsoft\Search Assistant\ACMru
: This registry key contains the most recent search history from Windows default search.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
: This registry key contains the most recent search history from Windows Explorer. (Windows >=7)
- References:
- Known categories:
5001: Internet Search Assistant
5603: Windows XP files and folder search
5604: “Word or phrase in a file” dialog box
5647: “For computers or people” selection in Search Results dialog box