List of Windows MRU Locations

From Forensics Wiki
Revision as of 11:14, 23 July 2008 by Pmow (Talk | contribs)

Jump to: navigation, search

Contents

Common

Regedit - Last accessed key

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Regedit - Favorites

Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites

MSPaint - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Wordpad - Recent Files

Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Common Dialog - Open

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Common Dialog - Save As

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

WMP8 XP - Recent Files

Software\Microsoft\MediaPlayer\Player\RecentFileList

WMP 8 XP - Recent URLs

Software\Microsoft\MediaPlayer\Player\RecentURLList

OE6 Stationery list 1 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List (ID=example)

OE 6 Stationery list 2 - New Mail

Identities\{C19958F2-22F3-4C6A-9AE0-12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide List (ID=example)

Windows 2000/XP

XP Search Files

Software\Microsoft\Search Assistant\ACMru\5603

Internet Search Assistant

Software\Microsoft\Search Assistant\ACMru\5001

Printers, Computers and People

Software\Microsoft\Search Assistant\ACMru\5647

XP Start Menu - Recent

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Remote Desktop - Connect

Software\Microsoft\Terminal Server Client\Default [MRUnumber]

Run dialog box

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows ME, 98, and 95

Doc Find Spec MRU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Find Computer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU

Printer Ports

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PrnPortsMRU

Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Window Size/Position

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Microsoft Office 2000

Winword - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Open\File Name MRU

Winword - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Word\Settings\Save As\File Name MRU

Winword - Recent Files

Software\Microsoft\Office\9.0\Word\Data

Excel - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Open\File Name MRU

Excel - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Excel\Settings\Save As\File Name MRU

Excel - Recent Files

Software\Microsoft\Office\9.0\Excel\Recent Files

Frontpage - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Open File\File Name MRU

Frontpage - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft FrontPage\Settings\Save As\File Name MRU

Frontpage - Recent lists

Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Web List
Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recently Created Servers
Software\Microsoft\FrontPage\Editor\Recently Used URLs

PowerPoint - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Open\File Name MRU

PowerPoint - Save As

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft PowerPoint\Settings\Save As\File Name MRU

PowerPoint - Recent Files

Software\Microsoft\Office\9.0\PowerPoint\Recent File List

Access - Open

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\Open\File Name MRU

Access - Filename MRU

Software\Microsoft\Office\9.0\Common\Open Find\Microsoft Access\Settings\File New Database\File Name MRU
Software\Microsoft\Office\9.0\Access\Settings

Internet Explorer

Recently Entered Addresses

USERNAME\software\microsoft\internet explorer\typedurls

Last Directory Saved To

USERNAME\software\microsoft\internet explorer

Adobe

Media Browser

HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU

Acrobat 5.0 Full

HKEY_CURRENT_USER\Software\ADOBE\Adobe Acrobat\5.0\AVGeneral\cRecentFiles

Acrobat Reader 5.0

HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\5.0\AVGeneral\cRecentFiles

Acrobat 8.0 Standard

HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVGeneral\cRecentFiles Pmow 16:14, 23 July 2008 (UTC)

Windows Explorer

List of Recent Programs Opened

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Save Locations by Filetype

HKEY_USERS\USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Most Recent Application's Use of DirectX

software\microsoft\direct3d\mostrecentapplication

List of Recent Files Opened, by Filetype

USERNAME\software\microsoft\windows\currentversion\explorer\recentdocs

Kazaa

Recent Search List

USERNAME\software\kazaa\search

Registry Editor

Last Key Accessed

USERNAME\software\microsoft\windows\currentversion\applets\regedit

Sources

Registry MRU Locations

How to Clear the Windows Explorer MRU Lists