# CIDSizeMRU

## Overview

**Evidence:** CIDSizeMRU\
**Description:** Enumerate CIDSizeMRU\
**Category:** System\
**Platform:** windows\
**Short Name:** cidsizemru\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

The CIDSizeMRU registry key tracks file names associated with window size and position preferences in common file dialogs. When users open or save files through applications, Windows remembers the dialog window size and position for each file.

This artifact can provide evidence of file names users have interacted with through file dialogs.

## Data Collected

This collector gathers structured data about cidsizemru.

### CIDSizeMRU Data

| Field           | Description                  | Example                                                                |
| --------------- | ---------------------------- | ---------------------------------------------------------------------- |
| `KeyPath`       | Registry key path            | Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU |
| `LastWriteTime` | Registry key last write time | 2023-10-15T14:30:00                                                    |
| `Value`         | MRU value name               | 0                                                                      |
| `Username`      | User account name            | user                                                                   |
| `FileName`      | File name                    | confidential-report.docx                                               |
| `MRUPosition`   | Position in MRU list         | 0                                                                      |
| `RegPath`       | Path to registry hive        | Registry/ntuser.dat                                                    |

## Collection Method

This collector:

* Collects user registry hives (ntuser.dat)
* Searches for: `Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU`
* Parses MRUListEx binary data
* Extracts file name strings
* Orders by MRU position

## Forensic Value

CIDSizeMRU provides additional evidence of file interaction through dialogs. Investigators use this data to identify files accessed through dialogs, corroborate other file access evidence, detect access to sensitive file names, and supplement OpenSavePidlMRU analysis.