Windows registry artifactRecentDocs
Files recently opened from Windows Explorer
- User Activity
- 2 keys
NTUSERUser
Registry keys
2 keys that RECmd reads for this artifact
NTUSERrecursiveSoftware\Microsoft\Windows\CurrentVersion\Explorer\RecentDocsFiles recently opened from Windows Explorer
UserrecursiveSoftware\Microsoft\Windows\CurrentVersion\Explorer\RecentDocsFiles recently opened from Windows Explorer - Windows Store UWP
References
6 links
- github.comRecentDocs plugin(opens in new tab)
- forensic4cast.com/2019/03/the-recentdocs-key-in-windows-10/(opens in new tab)
- andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/(opens in new tab)
- digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/(opens in new tab)
- sans.org/security-resources/posters/windows-forensic-analysis/170/download(opens in new tab)
- forensafe.com/blogs/recentDocs.html(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)