Search notes:

Registry: HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

This registry key contains a hierarchical representation of the folders that a user has interacted with. Thus, this key is interesting for forensic purposes.

Index