RecentDocs and the Open/Save MRU Keys
Also called RecentDocs, OpenSavePidlMRU, LastVisitedPidlMRU, ComDlg32, MRU keys.
- PLATFORM
- Windows
- CATEGORY
- File and Folder Access
- INDEX
- 7 of 36
- PROVES
- 4 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
Per-user registry lists of recently opened documents and of the folders used in Open and Save dialogs, ordered by recency but carrying a timestamp only for the most recent entry.
Where it lives
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs and ...\Explorer\ComDlg32\OpenSavePidlMRU and \LastVisitedPidlMRU
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of recentdocs and the open/save mru keys” is neither.
What it records
RecentDocs records file names opened through the shell, both in a combined list and in per-extension subkeys, with an ordering value giving most-recent-first sequence. The ComDlg32 keys record the shell items used in common file dialogs: OpenSavePidlMRU by file extension, capturing where files were opened from and saved to, and LastVisitedPidlMRU pairing an executable with the last folder that program used. Each key carries a single last-write time.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- That a document with a given name was opened by this account, and its position in the recency order
- Where files of a given type were saved to — the artifact that most directly addresses staging, since a save target is chosen deliberately
- Which executable last used which folder, from LastVisitedPidlMRU, connecting a program to a directory
- Names of files that no longer exist anywhere on the system
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- When any entry other than the most recent one was created. The key holds one last-write time, so only the top of each list can be dated — every other entry is undated and can only be bracketed by the entries around it
- The full path, in the case of RecentDocs, which records the file name rather than a complete path in the value data
- That the file was copied, edited, or read. These are records of shell and dialog interaction only
- That a file was not opened. The lists are capped, older entries are pushed off, and applications that do not use the common dialogs contribute nothing
- That the account holder personally performed the action, as against anyone using that logged-on session
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Asking the examiner to date an entry other than the most recent, which the key cannot support
- Pointing out that an ordering value gives sequence, not elapsed time, so two adjacent entries may be seconds or months apart
- Showing that the list is capped, so the absence of an older document proves nothing
- Challenging a full path attributed to a RecentDocs entry that records only a name
What survives, and for how long
The keys persist in the user hive across reboots and outlive the files they name, but each list has a fixed maximum and older entries are pushed off as new ones arrive. Clearing recent items in Explorer empties them, as does profile deletion.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
What is the RecentDocs registry key?
It is a per-user list, in the user's own registry hive, of documents recently opened through the Windows shell, kept both as a combined list and as per-extension subkeys. It records file names in most-recent-first order. Its main forensic value is that it names files that may no longer exist anywhere on the system, and its main limitation is that only one entry in each list can be dated.
Can you date an entry in a Windows MRU key?
Only the most recent one. A registry key carries a single last-write time, so in an ordered list of ten documents that timestamp belongs to whichever entry was written last. The other nine are undated; the ordering tells you their sequence relative to one another and nothing about elapsed time. An examiner who assigns dates to lower entries has invented them.
What does OpenSavePidlMRU show?
It records the folders used in Windows common Open and Save dialogs, organised by file extension. That makes it one of the better artifacts for staging behaviour, because a save destination is chosen deliberately in a way an opened path often is not. The companion LastVisitedPidlMRU pairs an executable with the last folder that program used, connecting a specific application to a specific directory.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
LNK Shortcut Files
Shortcut files Windows creates when a document is opened through the shell, retaining the target's full path, its size and timestamps, and often the volume serial number of the drive it lived on.
Jumplists
Per-application recent-file lists stored as compound files containing embedded LNK streams and an ordering list, recording which documents each program opened for a specific user.
Shellbags
Registry entries preserving the name, position in the folder tree, and display settings of folders a user browsed in Explorer — including folders that no longer exist.
Windows Search Index and WordWheelQuery
The desktop search database indexes file properties and, for many file types, full text — so it can retain the content of documents that were deleted before the index was rebuilt.
Whether the recentdocs and the open/save mru keysevidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.