30. LRU and MRU File Lists

• To find the least and most recently used files on a system

  • Windows 9x/ME

    • Search USER.DAT for MRU, LRU, or Recent

  • Windows NT/2000

    • Search NTUSER DAT for MRU, LRU, or Recent

  • Windows XP/2003

    • Search

      HKU\sid\Software\Microsoft\Windows\CurrentVersion\Explorer
      

      for the file extension of interest.

• File names will be listed even if the file no longer exists on the system.