Where Windows Search History Is Stored in Registry

This article explains the specific Windows Registry locations where search queries, indexer activity, and executed commands are stored. Windows tracks search terms, application launches, and indexer parameters across distinct user-level and machine-level Registry keys. By navigating through the Windows Registry Editor (regedit), administrators and forensic analysts can inspect or clear these historical records.

Windows Search Queries (WordWheelQuery)

Search strings entered into the Windows Search bar and File Explorer are recorded under the current user’s profile. The primary registry key responsible for storing these query terms is:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

• Data Format: The search terms are saved as individual binary values named sequentially (e.g., 0, 1, 2).
• MRUListEx: A specific binary entry named MRUListEx tracks the Most Recently Used (MRU) order of the entered search strings.

Executed Applications and Search Launches (RecentApps)

When you search for an application or command and execute it directly from the Windows Search/Start menu, Windows logs the execution history to track frequently accessed items. This data is recorded here:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps

Under this key, subkeys identified by GUIDs contain: * AppId: The file path or system identifier of the executed application. * LastAccessTime: A 64-bit timestamp indicating when the command or application was last run. * LaunchCount: A DWORD value tracking how many times the item has been launched via search.

Run Dialog Command History (RunMRU)

If commands or executables are executed directly via the standard Windows Run interface (Windows Key + R), the command history is tracked in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

• Values: Each command is saved as a string entry (a, b, c, etc.) with \1 appended to the end of the command line.
• MRUList: A string tracking the order in which the commands were run.

Windows Search Indexer System Configuration

The background Windows Search Indexer service (SearchIndexer.exe) manages the system index database, indexing locations, and crawl history. Machine-wide configuration and crawl state metadata are stored under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search

Key subpaths include: * Gathering and Crawl Settings:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex * Indexed File Extensions and Filters:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Extensions * Indexer Data Directory:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Databases\Windows (points to the path of Windows.edb, the actual index database).

How to Clear Search and Command History in the Registry

1. Press Windows Key + R, type regedit, and press Enter.
2. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery.
3. Select and delete all numbered binary values (keep the (Default) value intact).
4. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps.
5. Right-click and delete the individual GUID folders listed underneath to clear the launched apps history.
6. Restart the explorer.exe process or log out of Windows to apply the changes.