Windows Registry Knowledge Base: Most recently used

# Most recently used (MRU)

The Windows Registry contains various keys with information about Most Recently
files Used (MRU). Windows Explorer (or Windows shell), extensively uses such
keys. Several different variants of MRU keys are known to be used, such as:

* Keys with a MRUList value
* Keys with a MRUListEx value
* BagMRU key

## Keys with a MRUList value

Values:

Name | Data type | Description
--- | --- | ---
MRUList | | Contains a list of the most recently used (MRU) items. <br/> Consists of an array of UTF-16 little-endian formatted character value. <br/> The first value represents the most recently used item, the second the second recently used item and so forth. The last value indicates the end of the list and should be 0 (0x0000).
%ALPHA% | | Where %ALPHA% is a string in the form: "[a-z]" <br/> The value name corresponds to a string value in the MRUList value. E.g. a MRUList value of "a" (0x0061) corresponds to the value "a".

### String MRUList values

The following keys with a MRUList value contain %ALPHA% values that consists of
an UTF-16 little-endian formatted string with an end-of-string character.

Sub keys of: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\`

Registry key | Windows version | Description
--- | --- | ---
ComDlg32\LastVisitedMRU | 2000, XP |
ComDlg32\OpenSaveMRU\%EXTENSION% | 2000, XP | <br/> Where %EXTENSION% is a file extension like "exe" or "\*"
Doc Find Spec MRU | | Most recently used "Find Files" commands
FileExts\%EXTENSION%\OpenWithList | 2000, XP, Vista | Most recently used "Open With" commands <br/> Where %EXTENSION% is a file extension like ".exe"
FindComputerMRU | | Most recently used "Find Computer" commands
Map Network Drive MRU | XP | Most recently used mapped network drives
PrnPortsMRU | | Most recently used printer ports
RecentDocs | 2000, XP |
RecentDocs\%EXTENSION% | 2000, XP | <br/> Where %EXTENSION% is a file extension like ".exe" or "Folder"
RunMRU | NT4, 2000, XP, Vista | Most recently used "Run" commands
WordWheelQuery | |

### Shell Item List MRUList values

The following keys with a MRUList value contain %ALPHA% values that consists of
a Shell Item List.

Sub keys of: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\`

Registry key | Windows version | Description
--- | --- | ---
DesktopStreamMRU | NT4 | How icons are arranged on the desktop. <br/> Although the key is present on later versions of Windows it does not seem to be used anymore.

## Keys with a MRUListEx value

Values:

Name | Data type | Description
--- | --- | ---
MRUListEx | | Contains a list of the most recently used (MRU) items. <br/> Consists of an array of 4-byte little-endian values. <br/> The first value represents the most recently used item, the second the second recently used item and so forth. The last value indicates the end of the list and should be -1 (0xffffffff).
%NUMERIC% | | Where %NUMERIC% is a string in the form: "[0-9]+" <br/> The value name corresponds to a 4-byte numeric value in the MRUListEx value. E.g. a MRUListEx value of 0x00000001 corresponds to the value named "1".

The value data of the numeric value depends on the sub key.

### String MRUListEx values

The following keys with a MRUListEx value contain %NUMERIC% values that
consists of an UTF-16 little-endian formatted string with an end-of-string
character.

### Shell Item List MRUListEx values

The following keys with a MRUListEx value contain %NUMERIC% values that
consists of a Shell Item List.

Sub keys of: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\`

Registry key | Windows version | Description
--- | --- | ---
ComDlg32\OpenSavePidlMRU\%EXTENSION% | Vista | <br/> Where %EXTENSION% is a file extension like "exe" or "\*"
StreamMRU | 2000, XP |

### String and Shell Item MRUListEx values

The following keys with a MRUListEx value contain %NUMERIC% values that
consists of a String and Shell Item. The String and Shell Item is variable of
size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | ... | | The filename stored as an UTF-16 little-endian formatted string with end-of-string character
... | ... | | The filename stored as a Shell Item. <br/> The Shell Item is empty if not set.

Sub keys of: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\`

Registry key | Windows version | Description
--- | --- | ---
RecentDocs | Vista |
RecentDocs\%EXTENSION% | Vista | Where %EXTENSION% is a file extension like .exe or Folder

### String and Shell Item List MRUListEx values

The following keys with a MRUListEx value contain %NUMERIC% values that
consists of a String and Shell Item List. The String and Shell Item List is
variable of size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | ... | | The filename stored as an UTF-16 little-endian formatted string with end-of-string character
... | ... | | The path stored as a Shell Item List. <br/> The first Shell Item is empty if not set.

Sub keys of: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\`

Registry key | Windows version | Description
--- | --- | ---
ComDlg32\LastVisitedPidlMRU | Vista, 7 |

## BagMRU key

The values in the BagMRU and sub keys are also referred to as "shellbags".

BagMRU keys as of XP (stored in NTUSER.DAT)

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\BagMRU
```

Additional BagMRU keys as of Vista (stored in USRCLASS.DAT)

```
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\ShellNoRoam\BagMRU
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
HKEY_CURRENT_USER\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\ShellNoRoam\BagMRU
```

Seen in Windows 7:

```
HKEY_CURRENT_USER\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
```

The BagMRU sub keys form a hierarchy similar to a folder structure.

Values:

Name | Data type | Description
--- | --- | ---
NodeSlot | REG_DWORD | Contains the node slot index number (also referred to as bag number) <br/> This number corresponds to the sub key name the corresponding Bags sub key. <br/> E.g. bag number 1 in HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU relates to the Bags sub key HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1
NodeSlots | | Only present in the root BagMRU key.
MRUListEx | REG_BINARY | Contains a list of the most recently used (MRU) items. <br/> Consists of an array of 4-byte little-endian values. <br/> The first value represents the most recently used item, the second the second recently used item and so forth. The last value indicates the end of the list and should be -1 (0xffffffff).
%NUMERIC% | REG_BINARY | Where %NUMERIC% is a string in the form: "[0-9]+" <br/> The value name correspon