Difference between revisions of "List of Windows MRU Locations"

From Forensics Wiki
Jump to: navigation, search
(New page: ==Common== '''Regedit - Last accessed key''' :Software\Microsoft\Windows\CurrentVersion\Applets\Regedit '''Regedit - Favorites''' :Software\Microsoft\Windows\CurrentVersion\Applets\Reg...)
 
Line 82: Line 82:
 
:Software\Microsoft\Office\9.0\Access\Settings
 
:Software\Microsoft\Office\9.0\Access\Settings
  
 +
==Internet Explorer==
 +
'''Recently Entered Addresses'''
 +
:USERNAME\software\microsoft\internet explorer\typedurls
 +
'''Last Directory Saved To'''
 +
:USERNAME\software\microsoft\internet explorer
 +
 +
==Adobe==
 +
'''Media Browser'''
 +
:HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU
 +
'''Acrobat 5.0 Full'''
 +
:HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles
 +
'''Acrobat Reader 5.0'''
 +
:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles
 +
'''Acrobat 8.0 Standard'''
 +
:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles [[User:Pmow|Pmow]] 16:14, 23 July 2008 (UTC)
 +
 +
==Windows Explorer==
 +
'''List of Recent Programs Opened'''
 +
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
 +
'''Save Locations by Filetype'''
 +
:HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
 +
'''Most Recent Application's Use of DirectX'''
 +
:software\microsoft\direct3d\mostrecentapplication
 +
'''List of Recent Files Opened, by Filetype'''
 +
:USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs
 +
 +
==Kazaa==
 +
'''Recent Search List'''
 +
:USERNAME\software\kazaa\search
 +
 +
==Registry Editor==
 +
'''Last Key Accessed'''
 +
:USERNAME\software\microsoft\windows\currentversion\applets\regedit
 
==Sources==
 
==Sources==
  

Revision as of 11:14, 23 July 2008

Contents

Common

Regedit - Last accessed key

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Regedit - Favorites

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

MSPaint - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Wordpad - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Common Dialog - Open

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Common Dialog - Save As

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

WMP8 XP - Recent Files

Software\Microsoft\MediaPlayer\Player\RecentFileList

WMP 8 XP - Recent URLs

Software\Microsoft\MediaPlayer\Player\RecentURLList

OE6 Stationery list 1 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)

OE 6 Stationery list 2 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)

Windows 2000/XP

XP Search Files

Software\Microsoft\Search Assistant\ACMru\5603

Internet Search Assistant

Software\Microsoft\Search Assistant\ACMru\5001

Printers, Computers and People

Software\Microsoft\Search Assistant\ACMru\5647

XP Start Menu - Recent

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Remote Desktop - Connect

Software\Microsoft\Terminal Server Client\Default [MRUnumber]

Run dialog box

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows ME, 98, and 95

Doc Find Spec MRU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Find Computer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU

Printer Ports

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU

Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Window Size/Position

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Microsoft Office 2000

Winword - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU

Winword - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU

Winword - Recent Files

Software\Microsoft\Office\9.0\Word\Data

Excel - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU

Excel - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU

Excel - Recent Files

Software\Microsoft\Office\9.0\Excel\Recent Files

Frontpage - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU

Frontpage - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU

Frontpage - Recent lists

Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
Software\Microsoft\FrontPage\Editor\Recently Used URLs

PowerPoint - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU

PowerPoint - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU

PowerPoint - Recent Files

Software\Microsoft\Office\9.0\PowerPoint\Recent File List

Access - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU

Access - Filename MRU

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
Software\Microsoft\Office\9.0\Access\Settings

Internet Explorer

Recently Entered Addresses

USERNAME\software\microsoft\internet explorer\typedurls

Last Directory Saved To

USERNAME\software\microsoft\internet explorer

Adobe

Media Browser

HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU

Acrobat 5.0 Full

HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles

Acrobat Reader 5.0

HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles

Acrobat 8.0 Standard

HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles Pmow 16:14, 23 July 2008 (UTC)

Windows Explorer

List of Recent Programs Opened

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Save Locations by Filetype

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Most Recent Application's Use of DirectX

software\microsoft\direct3d\mostrecentapplication

List of Recent Files Opened, by Filetype

USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs

Kazaa

Recent Search List

USERNAME\software\kazaa\search

Registry Editor

Last Key Accessed

USERNAME\software\microsoft\windows\currentversion\applets\regedit

Sources

Registry MRU Locations

How to Clear the Windows Explorer MRU Lists