CHFI OS and Network Forensics Practice Question
Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?
⚠ Common exam trap
EC-Council often tests the distinction between registry-based MRU lists (stored in NTUSER.DAT) and file-system artifacts like Jump Lists or LNK files, so candidates mistakenly choose Jump Lists because they also track recent files, but they are not stored in the registry hive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MRU lists in the registry
The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Prefetch files
Why it's wrong here
Prefetch files, stored in C:\Windows\Prefetch with a .pf extension, are components of the Windows boot and application launch optimization system. They record the executable name, run count, and referenced files/directories to accelerate subsequent launches, but they do not track user-opened document MRU lists. Because they live on the file system rather than in the registry, they are not the artifact specifically designed for MRU tracking.
- ✗
Jump Lists
Why it's wrong here
Jump Lists are a Windows shell feature stored in C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations and CustomDestinations. These .automaticDestinations-ms and .customDestinations-ms files contain per-application recent files and tasks, serialized as shell item ID lists (LNK-like entries). Although they reflect recently accessed files, they are file-based artifacts separate from registry MRU lists and operate through the shell, not the registry.
- ✓
MRU lists in the registry
Why this is correct
Most Recently Used (MRU) lists in the registry are exactly the artifact designed for tracking recently opened files. For example, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU stores PIDLs of files selected through common dialog boxes, while application-specific keys like HKCU\Software\Microsoft\Notepad and HKCU\Software\Microsoft\WordPad record the last file paths opened by those applications. These registry values are maintained by the operating system and applications specifically to store this historical MRU data, making them the canonical answer.
- ✗
LNK files
Why it's wrong here
LNK files are Windows shortcut files that exist throughout the file system, including the Recent folder (%AppData%\Microsoft\Windows\Recent), desktop, and Start Menu. Each LNK file contains the target path, volume serial, and various timestamps, but it represents a single shortcut object rather than a maintained list of recent items. Since LNK files are file-based and not registry-resident, they are not the registry MRU artifact described in the question.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.