DFIRHub

Windows registry artifactRecent File List

Displays recent files accessed by the user with an application

  • User Activity
  • 5 keys
  • NTUSERUser

Registry keys

5 keys that RECmd reads for this artifact

  • NTUSER
    Software\*\*\Recent File List

    Displays recent files accessed by the user with an application

  • NTUSER
    Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

    Displays recent files accessed by the user with MS Paint

  • User
    Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

    Displays recent files accessed by the user with MS Paint Windows Store Version

  • NTUSER
    Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

    Displays recent files accessed by the user with MS WordPad

  • User
    Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

    Displays recent files accessed by the user with MS WordPad Windows Store Version

References

3 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)