shellbags

$ target-query <path/to/target> -f shellbags

Details

Module	dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin
Output	records

Module documentation

Windows Shellbags plugin.

Function documentation

Yields Windows Shellbags.

Shellbags are registry keys to improve user experience when using Windows Explorer. They contain information such as file and folder creation time and access time.

References:

• https://github.com/libyal/libfwsi

• https://www.giac.org/paper/gcfa/9576/windows-shellbag-forensics-in-depth/128522

• https://www.hackingarticles.in/forensic-investigation-shellbags/