Which list contains the most recent actions performed by a Windows User?

The correct answer is A. MRU. MRU stands for Most Recently Used. Windows maintains MRU lists in the registry (e.g., under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs and ComDlg32) that record the most recent files opened, commands run, URLs visited, and applications accessed by a…

Submitted by lars.no· Apr 18, 2026Disk Forensics

Question

Options

AMRU
BActivity
CRecents
DWindows Error Log

How the community answered

(37 responses)

A
89% (33)
B
3% (1)
C
5% (2)
D
3% (1)

Explanation

MRU stands for Most Recently Used. Windows maintains MRU lists in the registry (e.g., under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs and ComDlg32) that record the most recent files opened, commands run, URLs visited, and applications accessed by a user. Forensic investigators routinely examine MRU lists to reconstruct user activity. 'Recents' is a folder (not a structured list), 'Activity' is not a standard Windows forensic artifact, and 'Windows Error Log' records system errors, not user actions.

Topics

#Windows Forensics#User Activity#MRU Lists#Digital Artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice