windows // knows every file you opened

windows has been keeping receipts this whole time

every time you open a file on windows, the os quietly jots down a note about it. doesn't matter if you deleted the file five minutes later, moved it to a usb drive, or renamed it something sneaky. the registry still remembers you opened it, roughly when, and what folder it came from. this isn't malware, it's just windows doing what windows does. but if you've never looked at this data, you're basically carrying around a diary you didn't know you were writing.

the command, piece by piece

here's the line from the reel:

reg query "HKCU\...\Explorer\RecentDocs" /s | findstr /i .docx

breaking it down so it's not just magic text:

reg query asks the windows registry a question, in this case "what's in this key". HKCU\...\Explorer\RecentDocs is the actual path, the full thing is HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs. this key stores your recently opened files, and it's broken into sub-keys by file extension, so .docx files, .pdf files, .jpg files all get their own little bucket.

the /s flag tells reg query to dig recursively, so it doesn't just look at the top level, it pulls everything nested underneath too, including all those extension sub-buckets.

the | is a pipe, it takes the output of the reg query and hands it off to the next command instead of dumping it all on your screen.

findstr /i .docx filters that output down to lines containing ".docx", and the /i makes it case-insensitive so it catches .DOCX too. swap .docx for .pdf, .xlsx, whatever you're chasing.

why this matters if you're not a hacker

this is standard stuff in digital forensics and incident response. if someone is investigating a compromised machine, or a company is looking into whether an employee exfiltrated files before quitting, RecentDocs is one of the first places they check. it's a timeline of file activity that survives even after the original file is gone. the point of learning this isn't to snoop on anyone, it's to understand that this data exists on your own machine right now, and to know what it reveals about you if your laptop ever ends up in the wrong hands.

there's more than just the registry key

RecentDocs isn't the only place windows stashes this info. there's also a hidden folder full of shortcut files (.lnk) that point back to your recently opened documents, usually at:

%APPDATA%\Microsoft\Windows\Recent

each .lnk file can contain the original file path, the drive serial number, and timestamps, even if the source file was on a removable drive that's long gone. jump lists, which power those "recent files" menus when you right click an app in the taskbar, tell a similar story. all of this adds up to a surprisingly detailed picture of what you've been doing, sitting quietly in plain sight.

how to actually check and lock down your own exposure

run the command yourself and see what's in there. if you're shocked at how much detail is sitting in that registry key, here's what to actually do about it:

clear it out through settings instead of hacking the registry directly, go to settings > personalization > start > show recently opened items and turn it off, then click "clear" if your build offers it. this is the safe, supported way to wipe the list.

you can also nuke the recent items list manually by right-clicking the taskbar or start menu jump lists and selecting "clear recent items" where available, or by deleting the contents of the Recent folder mentioned above.

if you're on a shared or public-facing machine, disable jump lists and recent file tracking system-wide through group policy or the registry setting NoRecentDocsHistory, this stops windows from writing to that history at all going forward.

and if you're handling sensitive files regularly, consider using an encrypted container or a portable app setup that doesn't touch the normal file-open apis in the same way, less footprint means less to clean up later.

the takeaway

windows isn't spying on you in some sinister way, it's just designed to make your life convenient by remembering what you were working on. the tradeoff is that convenience leaves a trail. now that you know where that trail lives, you get to decide whether to leave it there or clean it up. either way, that's your call to make, not something you should discover for the first time during an incident.