BergssonForensics.
Menu
← Back to catalogue
User activity

OpenSavePidlMRU / LastVisitedPidlMRU

Common Windows file dialogs retain selected names, shell items or last-used locations in per-user MRU keys. Dialog interaction should be distinguished from a successful file read or save.

Listen to the full guide

Download MP32 min · AI narration

Useful for

Support that a file-dialog related selection or location was retained.

Important limit

Guarantee a document was fully opened, saved or executed.

Location & availability

NTUSER.DAT: Explorer\ComDlg32\OpenSavePidlMRU and LastVisitedPidlMRU

Available entries depend on the application, dialog implementation and user settings.

Fields to examine

  • Decoded shell item or path and extension grouping.
  • Application/location associations where recorded.
  • MRU order and key LastWrite context.

What it can establish

  • Support that a file-dialog related selection or location was retained.

What it cannot prove

  • Guarantee a document was fully opened, saved or executed.
  • Assign independent timestamps to entries that do not carry them.

Use it in a screenshare

  1. Preserve the user hive and parse PIDL structures using a suitable registry parser.
  2. Record the exact key and distinguish selected item paths from application last-visited folders.
  3. Correlate with application logs, RecentDocs or created files. Note that cancelled dialogs or different dialog implementations can change interpretation.

Worked example

A file dialog history references an archive on Desktop. It helps focus a search, but successful extraction requires evidence such as output files or a change-journal sequence.

Cross-check the finding

  • RecentDocs →Support a retained recent-document association in a profile.
  • Jump Lists →Support an application/destination association in the retained data.
  • USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.

Sources

Choose another artefact →