mru.lastvisited
¶
$ target-query <path/to/target> -f mru.lastvisited
Module |
|
Output |
|
Module documentation
Return MRU data stored at various registry keys.
The Windows registry contains various keys about Most Recently Used (MRU) files.
- References:
Function documentation
Return the LastVisitedMRU data.
The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
registry key
contains information about the executable used by an application to open the files that are documented at the
OpenSaveMRU registry key. Also each value tracks the directory location for the last file that was accessed by
that application.