How to identify recently opened files and searches on Windows

Recently opened files can be seen in C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent

Using RegRipper (https://github.com/keydet89/RegRipper2.8) you can verify this with the following:

rip.pl -r c:\Users\<username>\NTUSER.DAT -p recentdocs > rip-recent-docs-resultst.txt

This needs to be done on a copy of the DAT-file or from a mounted image, as the file cannot be accessed while running.

You can use the same tool to see what recent searches have been done from the Start menu:

rip.pl -r c:\Users\<username>\NTUSER.DAT -p wordwheelquery > rip-recent-start-searches-resultst.txt