recentfilecache#

$ target-query <path/to/target> -f recentfilecache
Details#

Module

os.windows.regf.recentfilecache.RecentFileCachePlugin

Output

records

Module documentation

Plugin that parses the RecentFileCache.bcf file.

Function documentation

Parse RecentFileCache.bcf.

Yields RecentFileCacheRecords with fields:

hostname (string): The target hostname. domain (string): The target domain. path (uri): The parsed path.