Windows registry artifactMicrosoft Office MRU
Microsoft Office Recent Files, lower Item value (Value Name) = more recent
- User Activity
- 4 keys
NTUSER
Registry keys
4 keys that RECmd reads for this artifact
NTUSERSOFTWARE\Microsoft\Office\*\*\User MRU\*\File MRUMicrosoft Office Recent Files, lower Item value (Value Name) = more recent
NTUSERSOFTWARE\Microsoft\Office\*\*\File MRUMicrosoft Office Recent Files, lower Item value (Value Name) = more recent
NTUSERSOFTWARE\Microsoft\Office\*\*\User MRU\*\Place MRUMicrosoft Office Recent Places
NTUSERSOFTWARE\Microsoft\Office\*\*\Place MRUMicrosoft Office Recent Places
References
5 links
- github.comOfficeMRU plugin(opens in new tab)
- eshlomo.us/windows-forensics-analysis-evidence/(opens in new tab)
- sans.org/security-resources/posters/windows-forensic-analysis/170/download(opens in new tab)
- andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/(opens in new tab)
- df-stream.com/category/microsoft-office-forensics/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)