Office Recent Files

Description: Microsoft Office programs will track their own Recent Files list to make it easier for users to remember the last file they were editing.

Location:

• C:\Users\<username>\NTUSER.DAT
  • NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_####\FileMRU 15.0 = Office 365

Notes: Similar to the Recent Files, this will track the last files that were opened by each MS Office application. The last entry added, per the MRU, will be the time the last file was opened by a specific Microsoft Office application.

Analysis:
Coming Soon!