Most Recently Used (MRU)
Overview
Evidence: Most Recently Used (MRU)
Description: Collect Most Recently Used (MRU) items
Category: System
Platform: macos
Short Name: mru
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
MRU data in Finder and app containers captures recently accessed folders, copies/moves, and secure bookmarks. This data is essential for reconstructing user file access and movement.
Data Collected
This collector gathers structured data about most recently used (mru).
Most Recently Used (MRU) Data
| Field | Description | Example |
|---|---|---|
User | User | Example value |
SourceFile | Source File | Example value |
SourceName | Source Name | Example value |
SourceKey | Source Key | Example value |
Name | Name | Example value |
URL | URL | Example value |
Collection Method
This collector parses Finder and sidebar plists and secure bookmarks, extracting recent items into most_recently_used.
Forensic Value
This evidence is crucial for forensic investigations as it shows recent file interactions and locations, supporting timeline and exfiltration analysis.