Tuesday, October 27, 2015

Registry Explorer\RecentDocuments Key

If you've ever looked through a memory dump and noticed the following registry key getting modified, here's my take on what it's doing.


It appears each time a file or folder is accessed in a Windows operating system, it records it in the RecentDocuments registry (which makes sense based on the name). For example, I opened the following registry key


And was able to read the following values

PracticeExam.docx, PracticeExam.docx.lnk

Which would seem to me to indicate that a word document was recently accessed.

Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.

No comments:

Post a Comment