ShellBags Explorer Alternatives: SBECmd, RegRipper & More
A fair comparison of ShellBags tools: ShellBags Explorer, SBECmd, RegRipper, Velociraptor, shellbags.py, Volatility and a browser parser. Strengths, gaps.
Blog
Articles, guides, and updates.
ShellBags Limitations and Anti-Forensics: What to Watch
What ShellBags cannot prove, what never creates them, how cleaners like PrivaZer or CCleaner remove them, and the traces deletion and tampering leave.
ShellBags Deleted Folders: Proving a Folder Existed
Use ShellBags to show a deleted or renamed folder existed: read its path, embedded times and MFT entry and sequence, then confirm with the $MFT and USN.
ShellBags and ZIP Files: Proving Archive Browsing
How ShellBags record browsing inside ZIP files and other archives in Explorer, what the compressed folder items contain, and how to interpret archive paths.
ShellBags USB Forensics: A Worked Investigation Example
A fictional case, step by step: ShellBags show a service account browsing a ZIP toolkit, a finance share and a USB drive. What they prove, and what they do not.
ShellBags on Windows 11, 10, 7 and XP: What Changed
How ShellBags differ across Windows XP, Vista, 7, 8.1, 10 and 11: hive locations, extension block versions, new root folders and native archive support.
ShellBags vs LNK Files, Jump Lists and RecentDocs
Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots.
Shell Item Format Explained: Inside a ShellBag Entry
Byte-level walkthrough of the shell items stored in BagMRU values: class types, file entry items, the 0xBEEF0004 block, MFT references and network items.
ShellBags Timestamps Explained: What Each Time Means
Key LastWrite, MRUListEx-derived last interacted, and embedded FAT times: what each ShellBags timestamp proves, with a worked example and the common traps.