How to Analyze ShellBags Online With a Browser Parser
Step-by-step: parse UsrClass.dat and NTUSER.DAT in your browser, read the tree and timeline, triage flagged folders, export CSV or JSON. Nothing uploaded.
Blog
Where Are ShellBags Stored? Locations and Collection
ShellBags registry locations in UsrClass.dat and NTUSER.DAT for Windows XP to 11, plus how to collect locked hives with their transaction logs, per user.
ShellBags Forensics: The Complete Guide for Investigators
What ShellBags are, where Windows stores them, what BagMRU and shell items prove, how to read their timestamps and where the artifact misleads analysts.