5
XP Search Files Software\Microsoft\Search Assistant\ACMru\5603
Internet Search Assistant Software\Microsoft\Search Assistant\ACMru\5001
Printers, Computers and People Software\Microsoft\Search Assistant\ACMru\5647
Pictures, music, and videos Software\Microsoft\Search Assistant\ACMru\5604
XP Start Menu - Recent Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
R. Desktop - Connect Software\Microsoft\Terminal Server Client\Default [MRUnumber]
Run dialog box Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Regedit - Last accessed key Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
Regedit - Favorites Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites
MSPaint - Recent Files Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
Mapped Network Drives - Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
Computer searched via Windows
Explorer
Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU
WordPad - Recent Files Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List
Common Dialog - Open Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
Common Dialog - Save As Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
WMP XP - Recent Files Software\Microsoft\MediaPlayer\Player\RecentFileList
WMP XP - Recent URLs Software\Microsoft\MediaPlayer\Player\RecentURLList
OE6 Stationery list 1 - New Mail
Identities\{C19958F2-22F3-4C6A-9AE0-
12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery List
*the CLSID varies, just an example given
OE 6 Stationery list 2 - New
Mail
Identities\{C19958F2-22F3-4C6A-9AE0-
12049CE0706F}\Software\Microsoft\Outlook Express\5.0\Recent Stationery Wide
List *the CLSID varies
PowerPoint - Recent Files Software\Microsoft\Office\10.0\PowerPoint\Recent File List
Access - Filename MRU
Software\Microsoft\Office\10.0\Common\Open Find\Microsoft Access\Settings\File
New Database\File Name MRU
FrontPage - Recent lists Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent File List
Excel - Recent Files Software\Microsoft\Office\10.0\Excel\Recent Files
Word - Recent Files Software\Microsoft\Office\10.0\Word\Data
Note: This list provides many common locations, but isn’t comprehensive.
For additional MRU lists: http://windowsxp.mvps.org/RegistryMRU.htm.
UserAssist
This key contains two or more subkeys, which have long hexadecimal names or globally
unique identifiers (GUIDs) and beneath each GUID is a subkey called Count. The Count
subkey contains recorded values that pertain to objects the user has accessed on the
system, such as Control Panel applets, shortcut files, programs, documents, media, etc.
HCU\Software\Microsoft\Windows\CurrentVersion \Explorer\UserAssist
These values, however, are encoded with the ROT-13 encryption algorithm. This
encryption technique is quite easy to decipher, as each character is substituted with the
character 13 spaces away from it in the ASCII table. A much faster and easier method to