Difference between revisions of "List of Windows MRU Locations"

From Forensics Wiki
Jump to: navigation, search
m (Added more sources)
 
Line 20: Line 20:
 
'''OE 6 Stationery list 2 - New Mail'''
 
'''OE 6 Stationery list 2 - New Mail'''
 
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
 
:Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)
 +
'''Map Network Drives'''
 +
:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
  
 
==Windows 2000/XP==
 
==Windows 2000/XP==
 +
'''''Recently Used Files'''''
 +
:C:\Documents and Settings\User\Recent
 
'''XP Search Files'''
 
'''XP Search Files'''
 
:Software\Microsoft\Search Assistant\ACMru\5603
 
:Software\Microsoft\Search Assistant\ACMru\5603
Line 120: Line 124:
  
 
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]
 
[http://support.microsoft.com/kb/142298 How to Clear the Windows Explorer MRU Lists]
 +
 +
[http://209.85.215.104/search?q=cache:ztqvo2Bfk9UJ:www.daniweb.com/forums/thread13426.html+adobe+MRU+location&hl=en&ct=clnk&cd=2&gl=us&client=firefox-a What are MRU files and why are they a security risk?]
 +
 +
[http://www.windowsbbs.com/windows-2000/47519-removing-mru-list-mapped-network-drives.html Removing MRU List from Mapped Network Drives]

Latest revision as of 12:23, 23 July 2008

Contents

Common

Regedit - Last accessed key

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Regedit - Favorites

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

MSPaint - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Wordpad - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Common Dialog - Open

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Common Dialog - Save As

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

WMP8 XP - Recent Files

Software\Microsoft\MediaPlayer\Player\RecentFileList

WMP 8 XP - Recent URLs

Software\Microsoft\MediaPlayer\Player\RecentURLList

OE6 Stationery list 1 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)

OE 6 Stationery list 2 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)

Map Network Drives

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU

Windows 2000/XP

Recently Used Files

C:\Documents and Settings\User\Recent

XP Search Files

Software\Microsoft\Search Assistant\ACMru\5603

Internet Search Assistant

Software\Microsoft\Search Assistant\ACMru\5001

Printers, Computers and People

Software\Microsoft\Search Assistant\ACMru\5647

XP Start Menu - Recent

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Remote Desktop - Connect

Software\Microsoft\Terminal Server Client\Default [MRUnumber]

Run dialog box

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows ME, 98, and 95

Doc Find Spec MRU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Find Computer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU

Printer Ports

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU

Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Window Size/Position

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Microsoft Office 2000

Winword - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU

Winword - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU

Winword - Recent Files

Software\Microsoft\Office\9.0\Word\Data

Excel - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU

Excel - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU

Excel - Recent Files

Software\Microsoft\Office\9.0\Excel\Recent Files

Frontpage - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU

Frontpage - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU

Frontpage - Recent lists

Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
Software\Microsoft\FrontPage\Editor\Recently Used URLs

PowerPoint - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU

PowerPoint - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU

PowerPoint - Recent Files

Software\Microsoft\Office\9.0\PowerPoint\Recent File List

Access - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU

Access - Filename MRU

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
Software\Microsoft\Office\9.0\Access\Settings

Internet Explorer

Recently Entered Addresses

USERNAME\software\microsoft\internet explorer\typedurls

Last Directory Saved To

USERNAME\software\microsoft\internet explorer

Adobe

Media Browser

HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU

Acrobat 5.0 Full

HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles

Acrobat Reader 5.0

HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles

Acrobat 8.0 Standard

HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles Pmow 16:14, 23 July 2008 (UTC)

Windows Explorer

List of Recent Programs Opened

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Save Locations by Filetype

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Most Recent Application's Use of DirectX

software\microsoft\direct3d\mostrecentapplication

List of Recent Files Opened, by Filetype

USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs

Kazaa

Recent Search List

USERNAME\software\kazaa\search

Registry Editor

Last Key Accessed

USERNAME\software\microsoft\windows\currentversion\applets\regedit

Sources

Registry MRU Locations

How to Clear the Windows Explorer MRU Lists

What are MRU files and why are they a security risk?

Removing MRU List from Mapped Network Drives