Windows registry artifactLastVisitedPidlMRU
Tracks the specific executable used by an application to open the files documented in OpenSavePidlMRU
- User Activity
- 3 keys
NTUSERUser
Registry keys
3 keys that RECmd reads for this artifact
NTUSERSoftware\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRUTracks the specific executable used by an application to open the files documented in OpenSavePidlMRU
UserSoftware\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRUTracks the specific executable used by an application to open the files documented in OpenSavePidlMRU - Windows Store UWP
NTUSERSoftware\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacyTracks the specific executable used by an application to open the files documented in OpenSavePidlMRU
References
6 links
- github.comLastVisitedPidlMRU plugin(opens in new tab)
- sans.org/blog/opensavemru-and-lastvisitedmru(opens in new tab)
- digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/(opens in new tab)
- eshlomo.us/windows-forensics-analysis-evidence/(opens in new tab)
- lifars.com/wp-content/uploads/2020/05/NTUSER-Technical-Guide.pdf(opens in new tab)
- forensafe.com/blogs/opensavemru.html(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)