opexxx
2/12/2017 - 11:47 AM

Get-RecentDocs.ps1

function Get-RecentDocs {

<#
    .SYNOPSIS
        Pulls names of recently opened documents from registry
        Author: Matthew Graeber (@mattifestation)
        License: BSD 3-Clause
        Required Dependencies: None
        Optional Dependencies: None
    .DESCRIPTION
        Reads registry for recently opened document names.
    .PARAMETER Extension
        The extension to filter for. Leaving blank will list all.
    .EXAMPLE
        Get-RecentDocs -Extension .docx
#>

    Param
    (
        [Parameter(Position = 0)]
        [String]
        $Extension = ''
    )

    $AsciiRegex = [Regex] '[\x20-\x7E]{5,}'
    $UnicodeRegex = [Regex] '[\u0020-\u007E]{5,}'

    Get-Item -Path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.$Extension | % {
        $Key = $_

        $Key.GetValueNames() | % {
            $AsciiString = [Text.Encoding]::GetEncoding(28591).GetString($Key.GetValue($_))
            $UnicodeString = [Text.Encoding]::Unicode.GetString($Key.GetValue($_))

            New-Object PSObject -Property @{
                ValueName = $_
                FileName = $UnicodeRegex.Match($UnicodeString).Value
                LinkName = $AsciiRegex.Match($AsciiString).Value
            }
        }
    }
}