TypedPaths is a Windows registry artefact that stores folder paths a user has typed into File Explorer and other path-entry fields. It is used in digital forensics to reconstruct navigation history and can expose network shares, local directories and other paths a user entered manually.
What TypedPaths Records
TypedPaths is a Windows registry artefact that preserves folder paths a user manually entered into File Explorer and other path-entry fields. It is not a full activity log, but a high-value trace of navigation intent, especially when investigating how a user reached local folders, mapped drives, or network shares.
Because it records what was typed, TypedPaths can capture destinations that are not obvious from other artefacts. That makes it useful when an examiner needs to distinguish between a folder that was merely present on a system and one that a person actually navigated to or searched for directly.
Why It Matters in Forensics
In timeline work, TypedPaths helps reconstruct user interaction with the filesystem at a finer granularity than directory listings alone. It can corroborate presence, access attempts, and manual navigation choices, which is especially useful when a case depends on proving whether a path was knowingly entered.
The artefact is also useful because it may preserve paths that are later removed, renamed, or no longer reachable. That makes it a supporting source for investigations where the analyst needs to infer past user intent from residual system state rather than from live evidence.
What Examiners Can Learn from It
TypedPaths can reveal local directories, administrative locations, UNC paths, and other destinations a user typed by hand. Those paths may point to staging areas, external shares, removable media locations, or other parts of the environment that merit follow-up.
In practice, the value is not only the path itself but the investigative direction it creates. A typed network share can lead an examiner toward file transfer activity, collaboration paths, or lateral movement questions, while a typed local path can help confirm where documents were opened or staged.
Limitations and Interpretation
TypedPaths should be treated as a history of entered paths, not as proof of file opening, file copying, or successful access. A recorded path may reflect a mistyped value, an exploratory lookup, or a path that never resolved cleanly.
For that reason, the artefact is strongest when corroborated with other Windows artefacts such as recent file traces, shellbags, jump lists, link files, event logs, and file system metadata. The surrounding evidence determines whether a typed path is merely an input attempt or part of a completed user action.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | TypedPaths is an artefact used to reconstruct user activity and navigation history. |
| AU-12 — Audit Record Generation | The artefact depends on recorded system activity that can later be examined in investigations. | |
| CM-6 — Configuration Settings | TypedPaths is a Windows registry artefact whose value depends on endpoint configuration and persistence. | |
| Recommendation — Correlate TypedPaths with other audit sources to reconstruct user navigation and investigate anomalies. Ensure endpoint logging and forensic artefact collection preserve user activity evidence. Harden and manage endpoint settings so forensic artefacts remain available for investigation. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | TypedPaths supports forensic review by providing evidence that can be compared with logs and other records. |
| Recommendation — Collect and retain endpoint evidence so investigators can validate user activity across sources. | ||
| MITRE ATT&CK | T1214 — Credentials from Password Stores | Typed paths can help identify where users navigated to during access or staging activity, aiding attack-path analysis. |
| Recommendation — Use path artefacts alongside ATT&CK mapping to trace suspicious navigation and follow-on activity. | ||
Practitioner Guidance
What to watch for: Treat TypedPaths as a lead generator, not a standalone conclusion. The most useful paths are often the ones that point to hidden shares, unusual administrative folders, or locations that do not fit the user’s normal working pattern.
Practitioner note: Preserve the registry source in context and compare TypedPaths with other user-activity artefacts before drawing conclusions about access, intent, or exfiltration.
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org