FirstFolder

Overview

Evidence: FirstFolder Description: Enumerate FirstFolder Category: System Platform: windows Short Name: firstfolder Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

The FirstFolder MRU (Most Recently Used) list tracks the first folder that was opened when using Windows common file dialogs (Open/Save dialogs). This registry artifact records which folders users or applications initially navigated to when opening or saving files.

This can provide evidence of file operations and folder access patterns associated with specific applications.

Data Collected

This collector gathers structured data about firstfolder.

FirstFolder Data

Field	Description	Example
KeyPath	Registry key path	Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
LastWriteTime	Registry key last write time	2023-10-15T14:30:00
Value	MRU value name	0
Username	User account name	user
Path	File name	document.docx
Folder	Folder path opened	C:\Users\user\Documents\Confidential
MRUPosition	Position in MRU list	0
RegPath	Path to registry hive	Registry/ntuser.dat

Collection Method

This collector:

• Collects user registry hives (ntuser.dat)

• Searches for: Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder

• Parses MRUListEx binary data to determine access order

• Extracts file names and folder paths from binary structures

• Orders entries by MRU position

Forensic Value

FirstFolder MRU reveals folder access through file dialogs and can indicate file operations. Investigators use this data to identify folders accessed for file operations, track file saving/opening patterns, detect access to hidden or sensitive folders, correlate with application usage, and establish file operation timelines.