Skip to contentGo to the directory tree
FolderRisk: Safe
  • Localized name

Recent C:\Users\<utilisateur>\AppData\Roaming\Microsoft\Windows\Recent

Shortcuts to the last files and folders the user opened, plus application jump lists; safe to clear.

Updated on By AltF4 Formation

What it’s for

Recent (FOLDERID_Recent, “Recent Items”) keeps one shortcut per document or folder opened recently. File Explorer and applications use it to populate recent files in Quick access and the Start menu.

What it contains

  • One .lnk shortcut per recently opened file or folder.
  • AutomaticDestinations: automatic application jump lists (.automaticDestinations-ms files).
  • CustomDestinations: jump lists customized by applications (.customDestinations-ms files).
  • Each shortcut keeps the original path, including for deleted files or files on removable drives.

Risks and best practices

  • Clearing the folder does not touch the files themselves. Only the history disappears, then rebuilds.
  • In forensics this is a valuable artifact (what the user opened, and when). Copy it before cleaning a suspect machine.
  • Shortcuts give away file and share names. Clear the folder before redeploying a workstation, and also use File Explorer Options > Privacy > Clear.
  • Empty the contents, not the folder itself.

Useful commands

Fenêtre de terminal
# The 20 most recent shortcuts
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -Force |
Sort-Object LastWriteTime -Descending | Select-Object -First 20 Name, LastWriteTime
# Target of a shortcut
(New-Object -ComObject WScript.Shell).CreateShortcut("$env:APPDATA\Microsoft\Windows\Recent\<file>.lnk").TargetPath
# Clear the history (remove -WhatIf to run)
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -Filter *.lnk -Force | Remove-Item -WhatIf
Remove-Item "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations\*" -WhatIf

Report a mistake