01Location
- NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
- NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
02Questions it answers
- Which commands, programs or UNC paths did the user type into the Run dialog?
- Which local or network paths were typed into the Explorer address bar?
- In which order were Run commands entered?
03Format and versions
| Format | RunMRU: MRUList value (UTF-16LE characters, first = most recent) and lettered values (a, b, c…) containing UTF-16LE strings. TypedPaths: REG_SZ values named url1, url2, … |
|---|---|
| Applies to | winreg-kb documents RunMRU for NT4, 2000, XP and Vista and gives no version limit for TypedPaths; RECmd's Kroll batch file targets both keys. |
04Key fields
| Field | What it tells you |
|---|---|
| MRUList (RunMRU) | String of value letters; the first letter is the most recent entry. |
| a, b, c… (RunMRU) | Typed command strings. |
| url1, url2… (TypedPaths) | Paths typed into Explorer. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Key last written time | FILETIME (UTC) | Reflects the last change to the key as a whole. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse both keys for every user profile.
- Order RunMRU values using MRUList and relate the most recent one to the key time.
- Corroborate typed commands and paths with Prefetch, ShellBags and network artifacts.
07Interpretation pitfalls
- The keys show what was typed, not whether the command succeeded or the path was reachable.
- Only the key has a timestamp; earlier entries cannot be dated from this artifact alone.
09Sources
- Most recently used (MRU) libyal / winreg-kb · checked 2026-10-14
- Typed paths libyal / winreg-kb · checked 2026-10-14
- RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14