..
    generated, remove this comment to keep this file

``shellbags``
=============

.. code-block:: console

    $ target-query <path/to/target> -f shellbags


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin``
    * - Output
      - ``records``

**Module documentation**

Windows Shellbags plugin.

**Function documentation**

Yields Windows Shellbags.

Shellbags are registry keys to improve user experience when using Windows Explorer.
They contain information such as file and folder creation time and access time.

References:
    - https://github.com/libyal/libfwsi
    - https://www.giac.org/paper/gcfa/9576/windows-shellbag-forensics-in-depth/128522
    - https://www.hackingarticles.in/forensic-investigation-shellbags/