mru.lastvisited

$ target-query <path/to/target> -f mru.lastvisited

Details

Module	dissect.target.plugins.os.windows.regf.mru.MRUPlugin
Output	records

Module documentation

Return MRU data stored at various registry keys.

The Windows registry contains various keys about Most Recently Used (MRU) files.

References:

• https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

Function documentation

Return the LastVisitedMRU data.

The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU registry key - renamed to LastVisitedPidlMRU since Windows Vista - contains information about the executable used by an application to open the files that are documented at the OpenSaveMRU registry key. Also, each value tracks the directory location for the last file that was accessed by that application.

References:

• https://digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/