RecentDocs
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocsRecentDocs is Explorer's global Most Recently Used list of files opened by the logged-on user, organized by file extension as individual subkeys. It persists each filename and a pointer to its Shell Link even after the source file is deleted — serving as a durable record of recent document interaction across any application.
Key Name
RecentDocs\{.ext} — per-extension subkeys (e.g., .pdf, .docx) each containing an MRU order value and binary PIDL entries for the filenames
Trace Type
Execution
Hive
NTUSER.DAT
Last Write Time
The per-extension subkey Last Write Time reflects the last time a file of that type was accessed — use it to build a file-type interaction timeline for the investigation window.
User Specific
Yes Strictly per-user — each profile maintains its own independent RecentDocs list.
Forensic Value
- Identify accessed file types: Organized by extension, RecentDocs reveals interaction with sensitive file types. Map these against WordWheelQuery searches to see what the user was looking for before opening files.
- Prove document interaction post-deletion: Filenames persist after deletion. Cross-reference these with LastVisitedPidlMRU to track the specific folder paths used during the final file save or open dialog.
- Reconstruct recent activity sequence: The MRUListEx value encodes the order files were accessed, letting analysts reconstruct the precise sequence of document interactions over time.
For more Info check out these Articles: LastVisitedPidlMRU, WordWheelQuery