drop ntuser.dat reg export and lnk file listing csv · identify documents in recent docs registry key with no corresponding lnk file · detect selective lnk clearing while registry entries remain · surface inconsistencies between artifact sources · runs locally
RecentDocs MRU vs %APPDATA%\Microsoft\Windows\Recent\ · registry-only = LNK cleared · LNK-only = MRU cleared
drop NTUSER.DAT .reg export · LECmd csv or Recent folder listing