Loads the "information on the files and folders recently opened or executed by the user with Windows Explorer" stored in the registry file. With the loaded data, you can check information on files and folders opened or executed by the user and whether documents and folders have been executed. You can also use it to identify the user's behavior.


reg-recent-docs [zipcharset=CHARSET] [zippath=ZIPFILE_PATH] FILE_PATH
Required Parameter
Path to the registry file. Using a wildcard (*) in the file name, you can retrieve all files containing a specific string pattern in the file name (e.g. D:\data\registry\*.DAT). If you provided the zippath option, input the registry file path in the ZIP file.
Optional Parameters
Character set to be used to decode the ZIP entry name and comment that are not encoded by UTF-8 encoding. Use the preferred MIME name or aliases registered in the following document:
Path to the ZIP file


The output fields are as follows:

file_nameStringFile name
file_extStringFile extension
last_writtenDateLast written time
orderIntegerFile order by extension


  1. Retrieve information by providing the file path.

    reg-recent-docs D:\data\registry\NTUSER.DAT
  2. Retrieve information when the zippath option is provided.

    reg-recent-docs zippath=D:\data\ registry\NTUSER.DAT
  3. Sort the order field by file extension.

    reg-recent-docs D:\data\registry\NTUSER.DAT
    | sort file_ext, order