Difference between revisions of "List of Windows MRU Locations"

From Forensics Wiki
Jump to: navigation, search
(New page: ==Common== '''Regedit - Last accessed key''' :Software\Microsoft\Windows\CurrentVersion\Applets\Regedit '''Regedit - Favorites''' :Software\Microsoft\Windows\CurrentVersion\Applets\Reg...)
 
m (Added more sources)
 
(One intermediate revision by one user not shown)
Line 20: Line 20:
 
'''OE 6 Stationery list 2 - New Mail'''
 
'''OE 6 Stationery list 2 - New Mail'''
 
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
 
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
 +
'''Map Network Drives'''
 +
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
  
 
==Windows 2000/XP==
 
==Windows 2000/XP==
 +
'''''Recently Used Files'''''
 +
:C:\Documents and Settings\User\Recent
 
'''XP Search Files'''
 
'''XP Search Files'''
 
:Software\Microsoft\Search Assistant\ACMru\5603
 
:Software\Microsoft\Search Assistant\ACMru\5603
Line 82: Line 86:
 
:Software\Microsoft\Office\9.0\Access\Settings
 
:Software\Microsoft\Office\9.0\Access\Settings
  
 +
==Internet Explorer==
 +
'''Recently Entered Addresses'''
 +
:USERNAME\software\microsoft\internet explorer\typedurls
 +
'''Last Directory Saved To'''
 +
:USERNAME\software\microsoft\internet explorer
 +
 +
==Adobe==
 +
'''Media Browser'''
 +
:HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU
 +
'''Acrobat 5.0 Full'''
 +
:HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles
 +
'''Acrobat Reader 5.0'''
 +
:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles
 +
'''Acrobat 8.0 Standard'''
 +
:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles [[User:Pmow|Pmow]] 16:14, 23 July 2008 (UTC)
 +
 +
==Windows Explorer==
 +
'''List of Recent Programs Opened'''
 +
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
 +
'''Save Locations by Filetype'''
 +
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
 +
'''Most Recent Application's Use of DirectX'''
 +
:software\microsoft\direct3d\mostrecentapplication
 +
'''List of Recent Files Opened, by Filetype'''
 +
:USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs
 +
 +
==Kazaa==
 +
'''Recent Search List'''
 +
:USERNAME\software\kazaa\search
 +
 +
==Registry Editor==
 +
'''Last Key Accessed'''
 +
:USERNAME\software\microsoft\windows\currentversion\applets\regedit
 
==Sources==
 
==Sources==
  
Line 87: Line 124:
  
 
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]
 
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]
 +
 +
[http://209.85.215.104/search?q=cache:ztqvo2Bfk9UJ:www.daniweb.com/forums/thread13426.html+adobe+MRU+location&hl=en&ct=clnk&cd=2&gl=us&client=firefox-a What are MRU files and why are they a security risk?]
 +
 +
[http://www.windowsbbs.com/windows-2000/47519-removing-mru-list-mapped-network-drives.html Removing MRU List from Mapped Network Drives]

Latest revision as of 12:23, 23 July 2008

Contents

[edit] Common

Regedit - Last accessed key

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Regedit - Favorites

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

MSPaint - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Wordpad - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Common Dialog - Open

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Common Dialog - Save As

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

WMP8 XP - Recent Files

Software\Microsoft\MediaPlayer\Player\RecentFileList

WMP 8 XP - Recent URLs

Software\Microsoft\MediaPlayer\Player\RecentURLList

OE6 Stationery list 1 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)

OE 6 Stationery list 2 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)

Map Network Drives

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU

[edit] Windows 2000/XP

Recently Used Files

C:\Documents and Settings\User\Recent

XP Search Files

Software\Microsoft\Search Assistant\ACMru\5603

Internet Search Assistant

Software\Microsoft\Search Assistant\ACMru\5001

Printers, Computers and People

Software\Microsoft\Search Assistant\ACMru\5647

XP Start Menu - Recent

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Remote Desktop - Connect

Software\Microsoft\Terminal Server Client\Default [MRUnumber]

Run dialog box

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

[edit] Windows ME, 98, and 95

Doc Find Spec MRU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Find Computer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU

Printer Ports

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU

Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Window Size/Position

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

[edit] Microsoft Office 2000

Winword - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU

Winword - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU

Winword - Recent Files

Software\Microsoft\Office\9.0\Word\Data

Excel - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU

Excel - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU

Excel - Recent Files

Software\Microsoft\Office\9.0\Excel\Recent Files

Frontpage - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU

Frontpage - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU

Frontpage - Recent lists

Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
Software\Microsoft\FrontPage\Editor\Recently Used URLs

PowerPoint - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU

PowerPoint - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU

PowerPoint - Recent Files

Software\Microsoft\Office\9.0\PowerPoint\Recent File List

Access - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU

Access - Filename MRU

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
Software\Microsoft\Office\9.0\Access\Settings

[edit] Internet Explorer

Recently Entered Addresses

USERNAME\software\microsoft\internet explorer\typedurls

Last Directory Saved To

USERNAME\software\microsoft\internet explorer

[edit] Adobe

Media Browser

HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU

Acrobat 5.0 Full

HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles

Acrobat Reader 5.0

HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles

Acrobat 8.0 Standard

HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles Pmow 16:14, 23 July 2008 (UTC)

[edit] Windows Explorer

List of Recent Programs Opened

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Save Locations by Filetype

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Most Recent Application's Use of DirectX

software\microsoft\direct3d\mostrecentapplication

List of Recent Files Opened, by Filetype

USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs

[edit] Kazaa

Recent Search List

USERNAME\software\kazaa\search

[edit] Registry Editor

Last Key Accessed

USERNAME\software\microsoft\windows\currentversion\applets\regedit

[edit] Sources

Registry MRU Locations

How to Clear the Windows Explorer MRU Lists

What are MRU files and why are they a security risk?

Removing MRU List from Mapped Network Drives

Retrieved from "http://www.forensicswiki.org/w/index.php?title=List_of_Windows_MRU_Locations&oldid=8313"
Personal tools
Namespaces

Variants
Actions
Navigation:
About forensicswiki.org:
Toolbox