ShellBags Explorer Alternatives: SBECmd, RegRipper & More
A fair comparison of ShellBags tools: ShellBags Explorer, SBECmd, RegRipper, Velociraptor, shellbags.py, Volatility and a browser parser. Strengths, gaps.
Posts tagged: #dfir
ShellBags Limitations and Anti-Forensics: What to Watch
What ShellBags cannot prove, what never creates them, how cleaners like PrivaZer or CCleaner remove them, and the traces deletion and tampering leave.
ShellBags Deleted Folders: Proving a Folder Existed
Use ShellBags to show a deleted or renamed folder existed: read its path, embedded times and MFT entry and sequence, then confirm with the $MFT and USN.
ShellBags and ZIP Files: Proving Archive Browsing
How ShellBags record browsing inside ZIP files and other archives in Explorer, what the compressed folder items contain, and how to interpret archive paths.
ShellBags on Windows 11, 10, 7 and XP: What Changed
How ShellBags differ across Windows XP, Vista, 7, 8.1, 10 and 11: hive locations, extension block versions, new root folders and native archive support.
ShellBags vs LNK Files, Jump Lists and RecentDocs
Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots.
Shell Item Format Explained: Inside a ShellBag Entry
Byte-level walkthrough of the shell items stored in BagMRU values: class types, file entry items, the 0xBEEF0004 block, MFT references and network items.
ShellBags Timestamps Explained: What Each Time Means
Key LastWrite, MRUListEx-derived last interacted, and embedded FAT times: what each ShellBags timestamp proves, with a worked example and the common traps.
How to Analyze ShellBags Online With a Browser Parser
Step-by-step: parse UsrClass.dat and NTUSER.DAT in your browser, read the tree and timeline, triage flagged folders, export CSV or JSON. Nothing uploaded.
Where Are ShellBags Stored? Locations and Collection
ShellBags registry locations in UsrClass.dat and NTUSER.DAT for Windows XP to 11, plus how to collect locked hives with their transaction logs, per user.
ShellBags Forensics: The Complete Guide for Investigators
What ShellBags are, where Windows stores them, what BagMRU and shell items prove, how to read their timestamps and where the artifact misleads analysts.