Get Recently Accessed Files

Description

Lists recently accessed files from Windows Recent Items LNK shortcuts, Explorer RecentDocs MRU registry keys, and optionally shell bag folder-navigation history. Output is automatically picked up by the file explorer and (with ResolveUncHosts) the intel network map.

Overview

Enumerates recently accessed files and folders from three Windows artefact sources:

  • RecentLnk — LNK shortcut files in %APPDATA%\Microsoft\Windows\Recent\. Each shortcut resolves to the target file or folder path via WScript.Shell (with a binary fallback parser). Sorted most-recently-modified first.
  • RecentDocsMRU — Per-extension most-recently-used lists stored under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs. Provides file names without full paths, ordered by the MRU index.
  • ShellBag (optional) — BagMRU registry tree at HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU. Records every folder the user has browsed in Explorer, including network shares and removable media.

All results share a common output schema so they can be sorted and filtered together.

Arguments

Parameter Type Default Description
IncludeShellBags bool false Include shell bag folder-navigation history.
MaxItems int 200 Maximum entries to return per source.

Output Fields

Field Description
Source Artefact origin: RecentLnk, RecentDocsMRU, or ShellBag.
Name File or folder display name.
TargetPath Resolved full path (empty when unavailable).
Extension File extension, e.g. .docx (from link target or MRU key).
Arguments Command-line arguments from LNK shortcuts (usually empty).
LastModified LNK file write time (null for MRU and ShellBag records).
Created LNK file creation time (null for MRU and ShellBag records).

Dependencies

  • recon

Operating Systems

  • Windows

Example Output

[
  {
    "Source": "RecentLnk",
    "Name": "Q4 Budget Final",
    "TargetPath": "C:\\Users\\jsmith\\Documents\\Finance\\Q4 Budget Final.xlsx",
    "Extension": ".xlsx",
    "Arguments": "",
    "LastModified": "2024-11-14T09:42:11",
    "Created": "2024-11-14T09:42:11"
  },
  {
    "Source": "RecentDocsMRU",
    "Name": "VPN_Config.ovpn",
    "TargetPath": "",
    "Extension": ".ovpn",
    "Arguments": "",
    "LastModified": null,
    "Created": null
  },
  {
    "Source": "ShellBag",
    "Name": "Confidential",
    "TargetPath": "C:\\\\192.168.1.50\\Finance\\Confidential",
    "Extension": "",
    "Arguments": "",
    "LastModified": null,
    "Created": null
  }
]
Scroll to Top