Skip to content

Instantly share code, notes, and snippets.

@rvrsh3ll
Last active January 21, 2024 15:09
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save rvrsh3ll/1a43f77a25cdda128694148c2e81fc3b to your computer and use it in GitHub Desktop.
Save rvrsh3ll/1a43f77a25cdda128694148c2e81fc3b to your computer and use it in GitHub Desktop.
function Get-RecentDocs {
<#
.SYNOPSIS
Pulls names of recently opened documents from registry
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
.DESCRIPTION
Reads registry for recently opened document names.
.PARAMETER Extension
The extension to filter for. Leaving blank will list all.
.EXAMPLE
Get-RecentDocs -Extension .docx
#>
Param
(
[Parameter(Position = 0)]
[String]
$Extension = ''
)
$AsciiRegex = [Regex] '[\x20-\x7E]{5,}'
$UnicodeRegex = [Regex] '[\u0020-\u007E]{5,}'
Get-Item -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.$Extension | % {
$Key = $_
$Key.GetValueNames() | % {
$AsciiString = [Text.Encoding]::GetEncoding(28591).GetString($Key.GetValue($_))
$UnicodeString = [Text.Encoding]::Unicode.GetString($Key.GetValue($_))
New-Object PSObject -Property @{
ValueName = $_
FileName = $UnicodeRegex.Match($UnicodeString).Value
LinkName = $AsciiRegex.Match($AsciiString).Value
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment