ShellBags Explorer Alternatives: SBECmd, RegRipper & More
A fair comparison of ShellBags tools: ShellBags Explorer, SBECmd, RegRipper, Velociraptor, shellbags.py, Volatility and a browser parser. Strengths, gaps.
TL;DR. Eric Zimmerman's ShellBags Explorer (GUI) and SBECmd (CLI) remain the reference: broad shell item coverage, transaction log replay, first/last interacted columns, batch processing. RegRipper gives quick text output inside a wider registry sweep. Velociraptor collects and parses at fleet scale. shellbags.py and Volatility's shellbags plugin cover Python pipelines and memory. The ShellBags Parser is the fastest way to look at a hive on any OS without installing anything, with triage flags and CSV/JSON export, but it does not yet replay logs, recover deleted keys, or decode every item type. For findings that go in a report, cross-check with a second tool.
Disclosure: I build the ShellBags Parser. I use SBECmd too, and I try to be precise below about where each tool is stronger.
The comparison
| Tool | Platform | Interface | Log replay | Notable strengths | Gaps to know |
|---|---|---|---|---|---|
| ShellBags Explorer / SBECmd | Windows (.NET) | GUI / CLI | Yes by default (--nl disables) | Broad item coverage; first/last interacted; "has explored"; -d directory and -l live registry modes; --dedupe; CSV | Windows only; GUI not scriptable |
RegRipper 3.0 shellbags.pl, shellbags_tln.pl | Windows (Perl, also runs elsewhere) | CLI / GUI | No, parse a clean hive | Part of a full registry sweep; TLN timeline output; checks MRUListEx before reporting times (per 4n6k) | Text report; item coverage depends on plugin version |
Velociraptor Windows.Forensics.Shellbags | Cross-platform agent | VQL / GUI | Raw registry parser | Fleet-wide hunts; outputs hive, key path, slot, full path, mod time, description | Fewer derived fields; also offers Windows.Applications.SBECmd to run SBECmd remotely |
| shellbags.py (Willi Ballenthin) | Python 2.7 | CLI | No | Bodyfile output for mactime-style timelines; scriptable | Python 2 dependency; older item coverage |
Volatility 2 shellbags | Python | CLI | n/a (memory) | Reads ShellBags from the in-memory registry of a RAM image | Volatility 2 only; memory image needed (RAM parser) |
| ShellBags Parser | Any modern browser | Web (WASM) | No (warns on dirty hives) | No install, nothing uploaded; drop hives, folders or ZIP triage collections; per-account grouping; tree + timeline; triage flags; CSV/JSON export | No log replay, no deleted-key recovery; MTP, ZIP-content and search items only best-effort; real-hive validation against SBECmd still in progress |
Sources for the flags and features: SBECmd options (SANS tool page), the Velociraptor artifact references linked above, the tools' repositories, and this site's README.
ShellBags Explorer and SBECmd
The de facto standard for good reasons. In practice:
- Coverage. Years of edge cases from real casework: delegate items, MTP devices, compressed folder content, control panel items, and many third-party shell extensions.
- Interpretation columns. "First interacted" and "Last interacted" from MRU logic, plus a "has explored" indicator derived from
Bagssettings. - Batch.
SBECmd.exe -d <dir> --csv <out>walks a triage collection and writes one CSV per hive;--deduperemoves duplicate hives (e.g. from shadow copies). - Dirty hives. Transaction logs are replayed unless you pass
--nl.
Trade-offs: Windows and a .NET runtime are required. That is fine on a forensic workstation, less so on a Mac, a Linux SIFT box, or a locked-down corporate laptop.
RegRipper
Harlan Carvey's RegRipper has had ShellBags plugins for Windows 7-era hives for over a decade. It shines when ShellBags are one of forty things you want out of a hive in one pass, and shellbags_tln.pl feeds a TLN timeline directly. As with any text-report tool, you lose the interactive tree, and coverage of newer item types depends on the plugin version you run. Replay logs before feeding it a dirty hive.
Velociraptor
At fleet scale, Velociraptor is the practical answer. Windows.Forensics.Shellbags uses Velociraptor's own raw registry parser on NTUSER.DAT and UsrClass.dat across C:\Users\*, so you can hunt for a UNC path or a drive letter across thousands of endpoints. For deep per-host analysis, collect the raw hives as well and parse them with a dedicated tool.
Python and memory options
- shellbags.py is small and scriptable, with bodyfile output that drops straight into a
mactimetimeline. It targets Python 2.7, so it needs a legacy environment. - Volatility 2's
shellbagsplugin parses the registry as it sits in memory. Useful when the hive on disk is gone, encrypted or dirty and you have a RAM image. Volatility 3 has registry plugins but, to my knowledge, no direct equivalent; check the current plugin list before relying on that.
ShellBags Parser (this site)
What it is good at:
- Zero install, private. Rust compiled to WebAssembly in a Web Worker; there is no upload endpoint.
- Triage speed. Drop a KAPE or Velociraptor ZIP; accounts are separated (SID from UsrClass, user name from NTUSER, or the
Users\<name>\path); flags surface other drives, network locations, archive paths and user-writable folders. - Transparency. Every entry shows its BagMRU key, MRU position, NodeSlot, extension version and raw hex; the timeline says whether a time is MRU-derived or a key last write.
- Robustness. Bounds-checked parsing of attacker-controllable data, with warnings rather than crashes on damaged hives.
What it does not do yet (from its own README): replay .LOG1/.LOG2, recover deleted BagMRU entries from unallocated cells, fully decode MTP, ZIP-content (0x52) and search-result items. Validation against a corpus of real Windows 7/10/11 hives with SBECmd diffs is on the roadmap. The step-by-step guide shows the workflow.
Which one when
| Situation | Reach for |
|---|---|
| First look at a hive on a Mac/Linux box or a locked-down laptop | ShellBags Parser |
| Full per-host analysis for a report | SBECmd / ShellBags Explorer, cross-checked with a second tool |
| One-pass registry sweep with many plugins | RegRipper |
| Hunting a path across the fleet | Velociraptor |
| Python pipeline, bodyfile timeline | shellbags.py |
| Only a RAM image | Volatility 2 shellbags |
| Suspected cleaning, deleted keys | Registry Explorer plus the checks in limitations and anti-forensics |
Whatever you choose, disagreements between tools are information. When two parsers show a different path for the same key, look at the raw bytes (shell item format) before trusting either.