File/Folder Opening

File/Folder Opening is used to identify user activity. In order to improve the user experience, Windows keeps tracks of user activity when interacting with Windows Explorer. We can use this to identify what files, and folders a user accessed.

Internet Explorer History

Track local, removable, and remote file access with Internet Explorer history.

Jump Lists

Windows 7 task bar (Jump List) is engineered to allow users to “jump” or access items have frequently or recently used quickly and easily.

Last-Visited MRU

Tracks the specific executable used by an application to open the files documented in the OpenSaveMRU key.

Office Recent Files

Microsoft Office programs will track their own Recent Files list to make it easier for users to remember the last file they were editing.

Open/Save MRU

Tracks files that have been opened or saved within a Windows shell dialog box.

Prefetch

Prefetch files contain files and directories referenced by an application.

Recent Files

Track the last files and folders opened and is used to populate data in “Recent” menus of the Start menu.

Shell Bags

Track folders that were accessed on the local machine, the network, and/or removable devices.

Shortcut (LNK) Files

Shortcut Files automatically created by Windows Recent Items Opening local and remote data files and documents will generate a shortcut file (.lnk)