credhist

$ target-query <path/to/target> -f credhist

Details

Module	dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin
Output	records

Module documentation

Windows CREDHIST file parser.

Windows XP: C:\Documents and Settings\username\Application Data\Microsoft\Protect\CREDHIST Windows 7 and up: C:\Users\username\AppData\Roaming\Microsoft\Protect\CREDHIST

References:

• https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#41

Function documentation

This is a namespace plugin. This means that by running this plugin, it will automatically run all other plugins under this namespace:

• credhist.credhist