Last Visited MRU

The LastVisitedMRU (Most Recently Used) and LastVisitedPidlMRU registry keys are instrumental in tracking the applications utilized by a user, as well as the specific directory locations where the last files were accessed by these applications. Present in different locations based on the Windows version, these keys offer a snapshot of user interactions with the file system, which is invaluable for forensic investigations, especially when piecing together the timeline of deleted file activities.

Key Insights:

• XP Location:

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

• Win7 and Later Location:

  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

Deeper Dive

LastVisitedMRU and LastVisitedPidlMRU

• These registry keys not only document the applications executed by the user but, more importantly, the last directory interactions. This can lead to the discovery of important, often hidden or overlooked directories. For investigators, it's particularly valuable for uncovering the traces of deleted files, as it shows where an application last accessed a file, providing clues to the original location of now-deleted or moved files.

Analyzing The Artifact

• To extract meaningful insights from these keys, forensic analysts can follow these steps:

  1. Identify the Application Usage: Determine which applications have been used by examining the entries in the LastVisitedMRU or LastVisitedPidlMRU keys.

  2. Trace Last Accessed Directories: Look for the paths associated with these applications to find the last accessed directories. This can indicate the user's file access patterns and highlight areas of the file system that were of interest.

  3. Investigate for Deleted Files: Knowing the last accessed directories can be a starting point to search for deleted files. Tools that recover deleted files can be directed towards these locations to potentially retrieve lost data.

  4. Contextual Analysis: Use the information about accessed directories and applications in conjunction with other forensic data to build a comprehensive picture of user behavior and file interaction history.

Tools for Analysis

• Registry Editors: View and analyze the contents of the NTUSER.DAT file.

• Forensic Software: Tools like EnCase, FTK, or Autopsy can parse these registry keys and present the data in a user-friendly manner.

• Deleted File Recovery Tools: Leverage file recovery tools in the directories highlighted by these keys to search for and potentially recover deleted files.

The LastVisitedMRU and LastVisitedPidlMRU keys serve as a critical link in understanding not just user behavior but also in the forensic investigation of file access patterns, particularly in cases involving deleted or otherwise obscured files.