..
    generated, remove this comment to keep this file

``mru.lastvisited``
===================

.. code-block:: console

    $ target-query <path/to/target> -f mru.lastvisited


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``os.windows.regf.mru.MRUPlugin``
    * - Output
      - ``records``

**Module documentation**

Return MRU data stored at various registry keys.

The Windows registry contains various keys about Most Recently Used (MRU) files.

References:
    - https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

**Function documentation**

Return the LastVisitedMRU data.

The ``HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU`` registry key
contains information about the executable used by an application to open the files that are documented at the
OpenSaveMRU registry key. Also each value tracks the directory location for the last file that was accessed by
that application.

References:
    - https://digitalf0rensics.wordpress.com/2014/01/17/windows-registry-and-forensics-part2/