ZEKASTRA

WindowsIntermediateFile and folder access

RecentDocs registry key

Per-user MRU key listing files and folders recently opened through Explorer, grouped by extension and ordered by MRUListEx.

01Location

  • NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
  • NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\<.extension>
  • NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder

02Questions it answers

  • Which files and folders did a user open recently, per extension?
  • In which order were they opened?
  • When did each extension sub-key last change?

03Format and versions

FormatVista and later: MRUListEx (array of 4-byte little-endian indices, most recent first) and numbered values each holding a UTF-16LE filename followed by a shell item. Windows 2000/XP: MRUList-ordered string values.
Applies toWindows 2000 and later; value structure changed with Windows Vista.

04Key fields

FieldWhat it tells you
MRUListExRecency order of the numbered values.
Numbered valueFilename (UTF-16LE) plus a shell item for the item.
Extension sub-keysSeparate MRU lists per extension, plus a Folder sub-key.

05Timestamps

FieldEncodingNote
Key last written timeFILETIME (UTC)Stored per key, so it cannot be assigned to a single value without corroboration.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. Parse RecentDocs and all sub-keys for every user profile.
  2. Order values by MRUListEx and decode the embedded shell items.
  3. Match names with LNK files in the Recent folder and with Jump Lists to recover full paths and times.

07Interpretation pitfalls

  • The key covers files opened from Windows Explorer; other access paths may leave no entry.
  • Values store a filename rather than a full path; reconstruct the path from other artifacts.

09Sources

  1. Most recently used (MRU) libyal / winreg-kb · checked 2026-10-14
  2. RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14
  3. Windows NT Registry File (REGF) format libyal / libregf (J. Metz) · checked 2026-10-14