> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/evidence-of-execution/office-apps-forensics/file-mru.md).

# File MRU

### What Is?

### Forensic Value:

Keeps track of files and paths opened within Office apps. 

### File Location:

* ntuser\Software\Microsoft\Office\\\<VERSION>\\\<APPNAME>\User MRU\LiveID\_####\File MRU
  * Personal Microsoft Account

* ntuser\Software\Microsoft\Office\\\<VERSION>\\\<APPNAME>\User MRU\ADAL\_####\File MRU
  * Active Directory Authentication Library

* NTUSER\Software\Microsoft\Office\\\<Version>\Word\Read Locations
  * Can show reading location and possible file existence.
  * Datetime shows when file was last closed.
    * Reg Explorer extracts these DateTime timestamps and uses for "Last Closed" column.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fz9X7cC2RinE9JBxBijhz%2Fimage.png?alt=media&amp;token=18bcc134-4c76-4a9f-9c4c-f1586ebd7b56" alt=""><figcaption></figcaption></figure>

{% tabs %}
{% tab title="Offline System" %}

{% endtab %}

{% tab title="Live System" %}

{% endtab %}
{% endtabs %}

### Parse Data:

### Considerations:

* Timestamps of each entry in Windows 64-bit Big Endian format
* Place MRU has duplicative entries but sometimes updated when File MRU is not.&#x20;

### Example:

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FK1tXXY4yvGfM1PTruJgq%2Fimage.png?alt=media&amp;token=77e315f3-27e9-4080-913b-9664469245b1" alt=""><figcaption></figcaption></figure>

### Analysis Tips:

### Anti-Forensics: