last directory accessed by the user using volatility3

676 Views Asked by At

Using volatility3, How can I find the last directory visited by the user in windows? In volatility2 we were able to find such thing using Shellbags plugin. But how can I do this in volatility3?

1

There are 1 best solutions below

1
On

You can use shellbags plugin.

volatility -f <filename> --profile=<profile-name> shellbags