> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/evidence-of-execution/office-apps-forensics/file-mru.md).

# File MRU

### What Is?

### Forensic Value:

Keeps track of files and paths opened within Office apps. 

### File Location:

* ntuser\Software\Microsoft\Office\\\<VERSION>\\\<APPNAME>\User MRU\LiveID\_####\File MRU
  * Personal Microsoft Account

* ntuser\Software\Microsoft\Office\\\<VERSION>\\\<APPNAME>\User MRU\ADAL\_####\File MRU
  * Active Directory Authentication Library

* NTUSER\Software\Microsoft\Office\\\<Version>\Word\Read Locations
  * Can show reading location and possible file existence.
  * Datetime shows when file was last closed.
    * Reg Explorer extracts these DateTime timestamps and uses for "Last Closed" column.

<figure><img src="/files/qIKdOpsh1B2OvExl0YVM" alt=""><figcaption></figcaption></figure>

{% tabs %}
{% tab title="Offline System" %}

{% endtab %}

{% tab title="Live System" %}

{% endtab %}
{% endtabs %}

### Parse Data:

### Considerations:

* Timestamps of each entry in Windows 64-bit Big Endian format
* Place MRU has duplicative entries but sometimes updated when File MRU is not.&#x20;

### Example:

<figure><img src="/files/oP821ZKpIy4nPoG5vr6B" alt=""><figcaption></figcaption></figure>

### Analysis Tips:

### Anti-Forensics: