±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36779
New Yesterday: 2 Visitors: 91

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Retrieving the most recently used word document

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

youcefb9
Member
 

Retrieving the most recently used word document

Post Posted: May 03, 06 04:15

What's the registry key (or other file system locations) that could potentialy locate the most recently used word documents (full path) in the system.

I am looking for a procedure that is guarantee to work in all Windows flavours (win2k, xp, 2003) and using any version of word (97, 2002, 2003,...etc).

regards

youcef  
 
  

keydet89
Senior Member
 

Re: Retrieving the most recently used word document

Post Posted: May 03, 06 05:31

This is covered in the regref.xls file located in the Windows Forensic Analysis Group on Yahoo Groups.

Specifically, within the NTUSER.DAT file for each user, look for:

\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

\Software\Microsoft\Office\{version}\Common\Open Find\{product}\Settings\Open\File Name MRU

\Software\Microsoft\Office\{version}\Common\Open Find\{product}\Settings\Save As\File Name MRU

\Software\Microsoft\Office\{version}\{app}\Recent Files

Harlan  
 
  

youcefb9
Member
 

Re: Retrieving the most recently used word document

Post Posted: May 03, 06 14:11

Harlan,
- how can you construct the full path given just the file name shown on RecentDocs?
- how can you tell the most recent from the RecentDocs?

The other keys you've mentioned didnt contain anything in my case (XP and word 2002). In addition the [Recent Files] key didnt exist at all (same thing is replicated in a test environment).

Is there any thing more conclusive.

The idea I got right now is an automated way of parsing [Documents and Settings\{user}\Recent] or its equivalent on other Windows systems, but this folder contains links. The solution I am envisaging is to parse the link file and grab the path of the target document. Alternatively I could open the link itself though I am not sure if opening a link using Windows ReadFile API would open the target file or the link itself.

Any ideas or clarifications on this.

regards

youcef  
 

Page 1 of 1