Microsoft Office and Outlook for Mac: MRU and Mailbox Data

What it is

Microsoft 365 apps on macOS are sandboxed App Store-style apps. Each keeps its preferences in its own container, and they share data through the UBF8T346G9.Office group container (the prefix is Microsoft's team ID). Two sources matter most for file access:

• Secure bookmarks: sandboxed apps must keep a security-scoped bookmark for every file the user opened, to reopen it later. Office stores them with a last-used date, which makes a reliable most-recently-used list.
• MicrosoftRegistrationDB.reg: a SQLite database that emulates the Windows registry for Office, with keys, values and last-write times.

Outlook for Mac stores a local copy of mailboxes in its profile folder. Apple Mail is covered separately in Mail.

Where it lives

What it proves

• A document was opened in an Office app from a specific path (local, external volume, network share or cloud folder), and when it was last used.
• The document's creation date and the volume it was on, from the bookmark data.
• The Office user name and initials configured for this account (from legacy keys), which end up in document metadata.
• Unsaved work: AutoRecovery copies can hold content the user never saved.
• Mail sent and received through Outlook, with folders, recipients and attachments, as cached locally.

Key fields

The bookmark blob is the same format Finder uses in Recent Items, so the same parsers apply.

Timestamps

kLastUsedDateKey is a plist date (UTC). write_time in MicrosoftRegistrationDB.reg is a Windows FILETIME (100-nanosecond intervals since 1601-01-01 UTC), as decoded by mac_apt. Bookmark creation dates are Mac absolute time. Outlook database date columns vary by version; confirm the epoch against a known message.

Retention

• Secure bookmarks accumulate per app and are pruned by Office; expect dozens to a few hundred entries.
• The registry database persists across Office updates.
• AutoRecovery files are removed when a document is saved or closed normally, and remain after a crash.
• Outlook keeps what the account's sync window allows; Exchange and Microsoft 365 mailboxes can be synced for a limited period only.

Collection

for app in Word Excel Powerpoint; do
  sudo ditto "/Users/<user>/Library/Containers/com.microsoft.$app/Data/Library/Preferences" \
    "./case/office_<user>/$app"
done
sudo ditto "/Users/<user>/Library/Group Containers/UBF8T346G9.Office" ./case/office_gc_<user>

The group container can be large when Outlook caches mail. UAC collects com.microsoft.office.plist and the securebookmarks plists; mac_apt MSOFFICE parses all three MRU sources.

Parsing

python3 mac_apt.py -o out E01 image.E01 MSOFFICE
plutil -p ./case/office_<user>/Word/com.microsoft.Word.securebookmarks.plist | grep -E 'file://|kLastUsedDateKey'
sqlite3 -readonly MicrosoftRegistrationDB.reg '.tables'

Investigator tips

• Paths under /Volumes/ show documents opened straight from USB drives or mounted images; match volume names with USB devices.
• Paths under ~/Library/CloudStorage/ link documents to cloud storage clients.
• Office documents downloaded from the web keep a quarantine record; macro-enabled files with a quarantine record and an MRU entry reconstruct a phishing chain.
• The dock menu "Open Recent" list in Saved Application State is a second, independent MRU for Office apps.
• Newer Outlook for Mac builds are moving to a different storage engine; if Outlook.sqlite is small or missing, look for other large files in the profile folder and treat the mailbox server as the authoritative source.