recent documents registry clearing artifact detector — free browser tool | fatcousin

home

drop ntuser.dat reg export · detect cleared recent documents registry entries · identify gaps in the recent document history · surface bulk clearing of document access records · runs locally

ntuser .reg export

drop ntuser.dat .reg export

or click

Select file

shimcache csv (optional)

drop shimcache / appcompat csv

or click

Select file

lnk csv (optional)

drop LECmd / Recent folder lnk csv

or click

Select file

RecentDocs MRUListEx · extension subkeys · cross-ref WINWORD vs .docx · LNK-only = selective MRU clearing

investigation window start (optional)

drop ntuser.dat .reg export · optional shimcache csv · optional LECmd lnk csv