shellbags

$ target-query <path/to/target> -f shellbags

Details

Module	os.windows.regf.shellbags.ShellBagsPlugin
Output	records

Module documentation

Windows Shellbags plugin.

References:

• https://github.com/libyal/libfwsi

Function documentation

Return Windows Shellbags.

Shellbags are registry keys to improve user experience when using Windows Explorer. It stores information about for example file/folder creation time and access time.

References:

• https://www.hackingarticles.in/forensic-investigation-shellbags/