Contains the list of all recent documents as a bunch and also the same data sorted by extension.
MRUListEx is list. It has a number of 4 byte values, each noting the sequence number of a document. It starts from the document’s number that was accessed some time age (first in the list) and ends with the most recently used one. This key also has a list of recently accessed folders.
⚠️🔎 I only had a short binary data stream under the
Tracks images opened with Microsoft application. Shows volume GUID (use other USB-related registry to assemble the picture), file path, data and time ⏰.
LastUpdateTime shows when the files was … . This date and time is very close
LastInteracted from ShellBags. Go to
SOFTWARE hive to find the device by the volume GUID and the to
This information is very useful for child abuse cases.
Xbox, on later versions, is a built-in game centre. However, one of the features is used beyond gaming: screen recordings.
ThumbCache: Path: C: \Users\ \*\AppData\ Local\Microsoft\Windows\ Explorer\ thumbcache\_\*.db
tmutil to find and list all snapshots