RecentDocs

Location & availability

NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Collection depends on profile settings, application integration and retention.

Fields to examine

• Recorded document names and shell-item data.
• MRU ordering where available.
• Registry key LastWrite, distinguished from individual item actions.

What it can establish

• Support a retained recent-document association in a profile.

What it cannot prove

• Identify the exact contents of similarly named files.
• Use a parent key LastWrite as the individual open time of every entry.

Use it in a screenshare

1. Collect the correct user hive and retain its transaction logs if available.
2. Decode the recorded items and distinguish MRU order from timestamps. Preserve the original key path.
3. Compare the item with Jump Lists and filesystem identity. Seek a path or file reference rather than joining common filenames alone.

Worked example

RecentDocs names a configuration file. That supports a recent-item lead, not proof that the shown version was edited. Compare the application’s own records and the file’s change history before attributing modifications.

Cross-check the finding

• Jump Lists →Support an application/destination association in the retained data.
• OpenSavePidlMRU / LastVisitedPidlMRU →Support that a file-dialog related selection or location was retained.
• USN Journal / $UsnJrnl →Support recorded file/directory changes and a sequence within retained journal coverage.

Sources

• RECmd — registry parser and batch definitions ↗