mru.lastvisited

$ target-query <path/to/target> -f mru.lastvisited

Details

Module	os.windows.regf.mru.MRUPlugin
Output	records

Module documentation

Return MRU data stored at various registry keys.

The Windows registry contains various keys about Most Recently Used (MRU) files.

References:

• https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

Function documentation

Return the LastVisitedMRU data.

The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU registry key contains information about the executable used by an application to open the files that are documented at the OpenSaveMRU registry key. Also each value tracks the directory location for the last file that was accessed by that application.

References:

• https://digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/