What's the registry key (or other file system locations) that could potentialy locate the most recently used word documents (full path) in the system.
I am looking for a procedure that is guarantee to work in all Windows flavours (win2k, xp, 2003) and using any version of word (97, 2002, 2003,…etc).
regards
youcef
This is covered in the regref.xls file located in the Windows Forensic Analysis Group on Yahoo Groups.
Specifically, within the NTUSER.DAT file for each user, look for
\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
\Software\Microsoft\Office\{version}\Common\Open Find\{product}\Settings\Open\File Name MRU
\Software\Microsoft\Office\{version}\Common\Open Find\{product}\Settings\Save As\File Name MRU
\Software\Microsoft\Office\{version}\{app}\Recent Files
Harlan
Harlan,
- how can you construct the full path given just the file name shown on RecentDocs?
- how can you tell the most recent from the RecentDocs?
The other keys you've mentioned didnt contain anything in my case (XP and word 2002). In addition the [Recent Files] key didnt exist at all (same thing is replicated in a test environment).
Is there any thing more conclusive.
The idea I got right now is an automated way of parsing [Documents and Settings\{user}\Recent] or its equivalent on other Windows systems, but this folder contains links. The solution I am envisaging is to parse the link file and grab the path of the target document. Alternatively I could open the link itself though I am not sure if opening a link using Windows ReadFile API would open the target file or the link itself.
Any ideas or clarifications on this.
regards
youcef