Navigate
A Target to collect files that are currently open in Notepad (Windows 11+)
*.bin
settings.dat
*.dat
4 paths
C:\Users\%user%\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState\*.bin
Contains .bin files which consist of the files opened in each tab in Windows Notepad
C:\Users\%user%\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\WindowState\*.bin
Contains .bin files tracking the state of the Notepad Window
C:\Users\%user%\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat
Retrieves settings.dat which is an Application Registry
C:\Users\%user%\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\*.dat
Retrieves User.dat and UserClasses.dat. User.dat contains MRU entries. UserClasses.dat contains Shell Bags.
1 link