| Plugin | Hive | What it gives |
|---|---|---|
| shellbags | USRCLASS.DAT | Folder browsing history |
| shellfolders | NTUSER.DAT | Known shell folders |
| typedpaths | NTUSER.DAT | Explorer typed paths |
| wordwheelquery | NTUSER.DAT | Explorer search terms |
| recentdocs | NTUSER.DAT | Opened docs |
| sevenzip | NTUSER.DAT | 7-Zip file history |
| winrar | NTUSER.DAT | WinRAR archive history |
| winzip | NTUSER.DAT | WinZip history |
| shares | SYSTEM | SMB Network Shares |
BLUE TEAM / DFI / ARTEFACT / WINDOWS / REGISTRY / RegRipper