editor.tabs

$ target-query <path/to/target> -f editor.tabs

Details

Module	apps.editor.editor.EditorPlugin
Output	records

Module documentation

Editor plugin.

Function documentation

Return contents from Windows 11 Notepad tabs - and its deleted content if available.

Windows Notepad application for Windows 11 is now able to restore both saved and unsaved tabs when you re-open the application.

Resources:

• https://github.com/fox-it/dissect.target/pull/540

• https://github.com/JustArion/Notepad-Tabs

• https://github.com/ogmini/Notepad-Tabstate-Buffer

• https://github.com/ogmini/Notepad-State-Library

• https://github.com/Nordgaren/tabstate-util

• https://github.com/Nordgaren/tabstate-util/issues/1

• https://medium.com/@mahmoudsoheem/new-digital-forensics-artifact-from-windows-notepad-527645906b7b

Yields WindowsNotepadSavedTabRecord or WindowsNotepadUnsavedTabRecord records:

ts              (datetime): The modification time of the tab.
content         (string):   The content of the tab.
path            (path):     The path to the tab file.
deleted_content (string):   The deleted content of the tab, if available.
digest          (digest):   A digest of the tab content.
saved_path      (path):     The path where the tab was saved.