Skip to content

Add NirSoft Recent File View Module - #1121

Merged
AndrewRathbun merged 2 commits into
EricZimmerman:masterfrom
Gear-I:NirSoft_RecentFilesView
Sep 16, 2026
Merged

AndrewRathbun merged 2 commits into
EricZimmerman:masterfrom
Gear-I:NirSoft_RecentFilesView

Conversation

@Gear-I

@Gear-I Gear-I commented Sep 16, 2026 •

Copy link
Copy Markdown
Contributor

Description

Adds a new LiveResponse module for NirSoft's RecentFilesView, which
surfaces recently opened/saved files from two sources: the Recent
folder (shell shortcuts) and the ComDlg32\OpenSaveMRU registry key
(recent Open/Save common-dialog history). This is distinct from the
existing OpenedFilesView module, which shows file handles open at
run time rather than historical MRU evidence.
Checked directly against NirSoft's own documentation
(nirsoft.net/utils/recent_files_view.html): RecentFilesView has no
command-line switch for pointing at an offline/collected Recent
folder or registry hive. Its "external source" loading exists only
as a GUI feature (Advanced Options, F9), not on the command line, so
it must run live against the target system.

Testing

Ran via kape.exe --msource C: --mdest <dest> --module NirSoft_RecentFilesView --debug against my own machine.

Result: 728 total rows exported.

  • 412 rows sourced from the Registry (OpenSaveMRU) - complete,
    correct file paths verified against real files on disk (scripts,
    downloaded media, installed executables).
  • 274 rows sourced from the Recent Folder - real, correct
    timestamps, but RecentFilesView's own CSV export leaves the
    Filename field blank for this source. Confirmed this is how the
    tool behaves, not a mistake in the module's CommandLine - the
    registry-sourced rows from the same run are complete, so it's
    source-specific to how NirSoft's own export handles Recent-folder
    entries. Documented as a known limitation in the module's comments
    rather than glossed over.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have generated a unique GUID for my Target(s)/Module(s)
  • I have placed the Target(s)/Module(s) in an appropriate subfolder in Targets or Modules. If one doesn't exist, I have either added it to the Misc folder or created a relevant subfolder with justification
  • I have set or updated the version of my Target(s)/Module(s)
  • I have verified that KAPE parses the Target(s)/Module(s) successfully via kape.exe, using --tlist/--mlist and corrected any errors
  • I have validated my Target(s)/Module(s) against test data and verified they are working as intended
  • I have made an attempt to document the artifacts within the Target(s) or Module(s) I am submitting. If documentation doesn't exist, I have placed N/A underneath the Documentation header
  • For Targets, I have consulted either the Target Guide, Target Template, Compound Target Guide, or Compound Target Template to ensure my Target(s) follow the same format
  • For Modules, I have consulted either the Module Guide, Module Template, Compound Module Guide, or Compound Module Template to ensure my Module(s) follow the same format

@AndrewRathbun AndrewRathbun added the enhancement New feature or request label Sep 16, 2026
@AndrewRathbun AndrewRathbun self-assigned this Sep 16, 2026
@AndrewRathbun
AndrewRathbun merged commit cc12f80 into EricZimmerman:master Sep 16, 2026
1 check passed
@Gear-I
Gear-I deleted the NirSoft_RecentFilesView branch September 16, 2026 19:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants