The following information was found at the registry key
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentD
ocs at the suspect’s Windows 7 computer.
1 CIMG1801.MOV
2 CIMG1800.MOV
3 CIMG2597.MOV
4 CIMG2596.MOV
MRUListEx 4 2 3 1
Which file did the suspect open most recently?
(a) CIMG1801.MOV
(b) CIMG1800.MOV
(c) CIMG2597.MOV
(d) CIMG2596.MOV