File/Folder Opening is used to identify user activity. In order to improve the user experience, Windows keeps tracks of user activity when interacting with Windows Explorer. We can use this to identify what files, and folders a user accessed.
Internet Explorer History
Track local, removable, and remote file access with Internet Explorer history.
Jump Lists
Windows 7 task bar (Jump List) is engineered to allow users to “jump” or access items have frequently or recently used quickly and easily.
Last-Visited MRU
Tracks the specific executable used by an application to open the files documented in the OpenSaveMRU key.
Office Recent Files
Microsoft Office programs will track their own Recent Files list to make it easier for users to remember the last file they were editing.
Open/Save MRU
Tracks files that have been opened or saved within a Windows shell dialog box.
Prefetch
Prefetch files contain files and directories referenced by an application.
Recent Files
Track the last files and folders opened and is used to populate data in “Recent” menus of the Start menu.
Shell Bags
Track folders that were accessed on the local machine, the network, and/or removable devices.
Shortcut (LNK) Files
Shortcut Files automatically created by Windows Recent Items Opening local and remote data files and documents will generate a shortcut file (.lnk)