ShellBags Deleted Folders: Proving a Folder Existed
Use ShellBags to show a deleted or renamed folder existed: read its path, embedded times and MFT entry and sequence, then confirm with the $MFT and USN.
Posts tagged: #timeline-analysis
ShellBags USB Forensics: A Worked Investigation Example
A fictional case, step by step: ShellBags show a service account browsing a ZIP toolkit, a finance share and a USB drive. What they prove, and what they do not.
ShellBags vs LNK Files, Jump Lists and RecentDocs
Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots.
ShellBags Timestamps Explained: What Each Time Means
Key LastWrite, MRUListEx-derived last interacted, and embedded FAT times: what each ShellBags timestamp proves, with a worked example and the common traps.