How to identify recently opened files and searches on Windows

Recently opened files can be seen in C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent

Using RegRipper ( you can verify this with the following: -r c:\Users\<username>\NTUSER.DAT -p recentdocs > rip-recent-docs-resultst.txt

This needs to be done on a copy of the DAT-file or from a mounted image, as the file cannot be accessed while running.

You can use the same tool to see what recent searches have been done from the Start menu: -r c:\Users\<username>\NTUSER.DAT -p wordwheelquery > rip-recent-start-searches-resultst.txt