01Location
- NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery (and sub-keys)
02Questions it answers
- Which keywords did the user search for from the Windows search box?
- In what order were the searches made?
- Do search terms precede access to related files, folders or programs?
03Format and versions
| Format | String MRU key: values containing UTF-16LE strings with an end-of-string character, ordered by an MRU list value (winreg-kb classifies WordWheelQuery among string MRU keys). |
|---|---|
| Applies to | The cited sources do not restrict the Windows versions; collect the key wherever it exists. |
04Key fields
| Field | What it tells you |
|---|---|
| MRU list value | Order of the stored search terms, most recent first. |
| Numbered values | Search terms as UTF-16LE strings. |
| Sub-keys | Additional term lists; collected recursively. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Key last written time | FILETIME (UTC) | Applies to the key; at best it bounds the most recent search. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse WordWheelQuery and its sub-keys for each profile.
- Order terms using the MRU list value.
- Correlate terms with RecentDocs, LNK files, ShellBags and Prefetch around the key time.
07Interpretation pitfalls
- A search term shows intent to find something, not that a result was opened.
- Individual terms carry no timestamp of their own.
09Sources
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14
- Most recently used (MRU) libyal / winreg-kb · checked 2026-10-14
- RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14