LastVisitedPidlMRU
Overview
Section titled “Overview”Evidence: LastVisitedPidlMRU
Description: Enumerate LastVisitedPidlMRU
Category: System
Platform: windows
Short Name: lstvstpidmru
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”LastVisitedPidlMRU tracks which folder a user last visited when using a file open/save dialog for each application. This registry artifact creates an association between executables and the folders users accessed while using those applications.
This can reveal which folders users accessed with specific programs, including applications that may have been deleted or are suspicious.
Data Collected
Section titled “Data Collected”This collector gathers structured data about lastvisitedpidlmru.
LastVisitedPidlMRU Data
Section titled “LastVisitedPidlMRU Data”| Field | Description | Example |
|---|---|---|
KeyPath | Registry key path | Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU |
LastWriteTime | Registry key last write time | 2023-10-15T14:30:00 |
Value | MRU value name | 0 |
Username | User account name | user |
Path | Folder path accessed | C:\Users\user\Documents\Confidential |
MRUPosition | Position in MRU list | 0 |
RegPath | Path to registry hive | Registry/ntuser.dat |
Collection Method
Section titled “Collection Method”This collector:
- Collects user registry hives (ntuser.dat)
- Searches for:
Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU - Parses MRUListEx binary data
- Decodes shell item list data using libfwsi
- Extracts folder paths and application associations
- Orders by MRU position
Forensic Value
Section titled “Forensic Value”LastVisitedPidlMRU reveals application-specific folder access and can connect executables to data locations. Investigators use this data to identify which folders were accessed by specific programs, detect malware accessing sensitive directories, track file dialog operations, correlate applications with data access, prove application interaction with specific folders, and identify suspicious application-folder associations.