CIDSizeMRU lives right next to LastVisitedPidlMRU, under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU. Despite the name, this isn't just a window size. Each entry is a numbered MRU slot (0, 1, 2...) whose value data is a UTF-16 string, with an MRUListEx value tracking which slot was used most recently. Inspecting a live registry, a slot can hold the name of the application that used the common Open/Save dialog, for example mspaint.exe. Forensic references also document this key holding actual file names in other cases, which is why examiners treat it as corroborating evidence alongside OpenSavePidlMRU when reconstructing which documents, including sensitive ones, were accessed through a dialog.
Either way, an application name or a document name, it's a record worth clearing. PrivaZer removes these entries along with LastVisitedPidlMRU.
| Field | What it reveals | Processing by PrivaZer |
|---|---|---|
| Slot number | A position in the MRU list, not identifying on its own | Removed |
| Identifying string | Which app, or which document, used the dialog | Removed |
| MRUListEx | Recency ranking across recent applications | Removed |
The name of the key is misleading: what's actually stored is not a size but an identifying string, an application name in the case we inspected, though forensic references also document document file names appearing here, each in its own numbered slot, with MRUListEx tracking the order. That makes it a genuine usage record, valuable to examiners as corroborating evidence alongside OpenSavePidlMRU when identifying which files were accessed through a dialog. PrivaZer clears these entries so that trail no longer sits in the registry.
Yes. PrivaZer detects and removes the values under ComDlg32\CIDSizeMRU as part of a scan, and can target them on their own.
Like its ComDlg32 sibling LastVisitedPidlMRU, this lives entirely under your per-user hive (HKEY_CURRENT_USER). PrivaZer deletes the values directly, no lock to work around, no reboot needed, and no administrator rights required since it's your own user hive.
Yes. Closing the dialog, or uninstalling the program that used it, doesn't remove its slot. Whatever the entry names, an application no longer installed, or a document you've since deleted, stays in the registry until something rewrites or removes it. Cleaning CIDSizeMRU is what removes that leftover.
Yes. Clearing it doesn't touch your files, your installed programs or system stability. Windows simply starts recording again as you use Open/Save dialogs going forward. If the key's name does correspond to some dialog sizing behavior in certain apps, at most you'd see a dialog briefly reopen at its default size before Windows remembers your preference again.
Yes, and that's normal. The next application that uses the common Open/Save dialog gets a fresh slot. Cleaning removes the historical trail up to that point. Run PrivaZer periodically to keep it short.
They live in the same ComDlg32 branch and share the same MRU list structure, and turn out to be closer siblings than the names suggest. LastVisitedPidlMRU pairs a specific application with a specific folder, encoded as a PIDL that can survive the drive being removed. CIDSizeMRU records an identifying string, an app name in the entry we inspected, though it can also hold a document file name, in each numbered slot, without a folder attached. Forensic examiners use it to corroborate what OpenSavePidlMRU shows about which files were opened or saved.
See: LastVisitedPidlMRU (most recently used files in Open/Save dialogs).
