Recent files in Office 365 apps

AppleScript
#1

Recent files for M$ Office 365 applications seem to be stored in a file named MicrosoftRegistrationDB.reg.
I found some sqlite3 shell scripts on the internet to parse it, but they don’t work here.
Does anyone know how to read this SQL file to extract/remove all recent file references from it?

macOS 12.7.6 (21H1320) French localization
Script Debugger 8.0.10 (8A88)
shell : zsh

#2

Where is that file stored?
I’m going to see if I can edit it with this:

Freeware | Late Night Software
SQLite Lib 1.0.0 and SQLite Lib2 1.1.0

SQLite Lib2 and SQLite Lib are libraries for fast and efficient SQLite programming from AppleScript, based on the well-known open-source FMDB Framework. If you ever need to access SQLite databases, or need a simple database for your scripts, one of these is the answer. Functionally similar, SQLite Lib2 requires macOS 10.11 or later and includes a terminology dictionary, whereas SQLite Lib uses traditional handlers, and works under macOS 10.10 and later. Note that scripts using SQLite Lib and SQLit Lib2 cannot be edited in Script Editor in Mojave or later because of security settings. You need to use Script Debugger. See Catalina Security and Script Libraries for Catalina installation details. (Updated July 17, 2020.)

#3

FYI, I think I found it and SQLite Lib2 couldn’t open it.

#4

Thank you for trying!

#5

I was able to get the recent document info from the registry file using DB Browser for SQLite and then running the SQLite code found at this blog post: Yogesh Khatri’s forensic blog: Flexing SQL muscle for parsing an MS db on OSX

You can export it to CSV or whatever and then find any Key containing MruUserData and a valueName of DocumentUrl to get the path to recent documents.

I have no experience with scripting sqlite so I can’t help there, I’m afraid, but maybe this will be of use.

#6

I found a solution to read the .reg file:

set thePath to quoted form of "/Users/me/Library/Group Containers/UBF8T346G9.Office/MicrosoftRegistrationDB/MicrosoftRegistrationDB_xxxxxxxxxxxxxxxx.reg"
set theQuery to " \"select * from HKEY_CURRENT_USER_values where node_id in (SELECT node_id FROM HKEY_CURRENT_USER_values WHERE name='DocumentUrl');\""
set theString to do shell script "sqlite3 " & thePath & theQuery

The result is a text list of items like this:

1055|Application|1|PowerPoint
1055|DocumentUrl|1|file:///Users/username/folder/someFile.pptx
1055|FileName|1|someFile.pptx
1055|FileSizeInBytes|11|10
1055|FutureAccessToken|1|CECA60E6-08BD-4874-8248-EC01FCE2B1E9
1055|IsPinned|4|0
1055|Path|1|HardDrive ‎» Users ‎» username ‎» folder
1055|StorageHost|4|100
1055|Timestamp|1|2025-02-07T11:29:36.2200000Z
…/…

DocumentUrl can be returned like above or like this:

1055|DocumentUrl|1|/Users/username/folder/someFile.pptx

Can we add some code to the query to get the DocumentUrl values only?
(I’m able to parse it with an Applescript regex search but it will be fun to learn the “shell way”!)