mru.recentdocs
¶
$ target-query <path/to/target> -f mru.recentdocs
Module |
|
Output |
|
Module documentation
Return MRU data stored at various registry keys.
The Windows registry contains various keys about Most Recently Used (MRU) files.
- References:
Function documentation
Return the RecentDocs data.
The HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
registry key contains
information about the last 10 documents that the currently logged on user accessed or executed via Windows
Explorer.