Open Recent Files Folder

Run: shell:Recent in the Run dialog (Win+R)

Location: %AppData%\Microsoft\Windows\Recent
(C:\Users\username\AppData\Roaming\Microsoft\Windows\Recent)

Contains .lnk (shortcut) files pointing to recently accessed files and folders. Windows creates these automatically whenever a user opens a file.

Forensics — High-Value Evidence Location

The Recent folder is one of the most valuable artifacts in Windows forensics. It reveals exactly which files a user accessed, when, and from where — including network paths and external drives.

LNK files contain:

• Full target path (local or UNC network path)
• Timestamps for both the LNK file and the original target (created, modified, accessed)
• Volume serial number of the source drive
• MAC address of the machine that created the LNK file
• Drive type (local, network, removable)

This means you can prove a file was accessed even if the original file and drive are gone — the LNK artifact remains.

Parse LNK Files

• LECmd (Eric Zimmerman's Tools) — best free tool: LECmd.exe -f file.lnk or -d directory --csv output.csv
• python-lnk — Python library for programmatic parsing
• DB Browser + LNK parser in forensic suites (Autopsy, FTK)

PowerShell — List Recent Items

Get-ChildItem shell:Recent | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime

Clear Recent Items

Right-click Start or Taskbar → Taskbar settings → Privacy → Clear. This deletes the LNK files but may leave traces in the jump list database files.