FolderRisk: Safe
- Localized name
Recent C:\Users\<utilisateur>\AppData\Roaming\Microsoft\Windows\Recent
Shortcuts to the last files and folders the user opened, plus application jump lists; safe to clear.
What it’s for
Recent (FOLDERID_Recent, “Recent Items”) keeps one shortcut per document or folder opened recently. File Explorer and applications use it to populate recent files in Quick access and the Start menu.
What it contains
- One
.lnkshortcut per recently opened file or folder. AutomaticDestinations: automatic application jump lists (.automaticDestinations-msfiles).CustomDestinations: jump lists customized by applications (.customDestinations-msfiles).- Each shortcut keeps the original path, including for deleted files or files on removable drives.
Risks and best practices
- Clearing the folder does not touch the files themselves. Only the history disappears, then rebuilds.
- In forensics this is a valuable artifact (what the user opened, and when). Copy it before cleaning a suspect machine.
- Shortcuts give away file and share names. Clear the folder before redeploying a workstation, and also use File Explorer Options > Privacy > Clear.
- Empty the contents, not the folder itself.
Useful commands
# The 20 most recent shortcutsGet-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -Force | Sort-Object LastWriteTime -Descending | Select-Object -First 20 Name, LastWriteTime
# Target of a shortcut(New-Object -ComObject WScript.Shell).CreateShortcut("$env:APPDATA\Microsoft\Windows\Recent\<file>.lnk").TargetPath
# Clear the history (remove -WhatIf to run)Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -Filter *.lnk -Force | Remove-Item -WhatIfRemove-Item "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations\*" -WhatIf