mru

$ target-query <path/to/target> -f mru

Details

Module	os.windows.regf.mru.MRUPlugin
Output	records

Module documentation

Return MRU data stored at various registry keys.

The Windows registry contains various keys about Most Recently Used (MRU) files.

References:

• https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

Function documentation

This is a namespace plugin. This means that by running this plugin, it will automatically run all other plugins under this namespace:

• mru.acmru

• mru.lastvisited

• mru.msoffice

• mru.mstsc

• mru.networkdrive

• mru.opensave

• mru.recentdocs

• mru.run