last directory accessed by the user using volatility3

Question

Using volatility3, How can I find the last directory visited by the user in windows? In volatility2 we were able to find such thing using Shellbags plugin. But how can I do this in volatility3?

Answer 1

You can use shellbags plugin.

volatility -f <filename> --profile=<profile-name> shellbags