Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / DFI / ARTEFACT / WINDOWS / REGISTRY / RegRipper

File & Folder Access

PluginHiveWhat it gives
shellbagsUSRCLASS.DATFolder browsing history
shellfoldersNTUSER.DATKnown shell folders
typedpathsNTUSER.DATExplorer typed paths
wordwheelqueryNTUSER.DATExplorer search terms
recentdocsNTUSER.DATOpened docs
sevenzipNTUSER.DAT7-Zip file history
winrarNTUSER.DATWinRAR archive history
winzipNTUSER.DATWinZip history
sharesSYSTEMSMB Network Shares