https://www.shellbagsparser.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:44:01 GMT https://www.shellbagsparser.com/en/blog/shellbags-explorer-alternatives https://www.shellbagsparser.com/en/blog/shellbags-explorer-alternatives A fair comparison of ShellBags tools: ShellBags Explorer, SBECmd, RegRipper, Velociraptor, shellbags.py, Volatility and a browser parser. Strengths, gaps. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-anti-forensics-limitations https://www.shellbagsparser.com/en/blog/shellbags-anti-forensics-limitations What ShellBags cannot prove, what never creates them, how cleaners like PrivaZer or CCleaner remove them, and the traces deletion and tampering leave. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-deleted-folders https://www.shellbagsparser.com/en/blog/shellbags-deleted-folders Use ShellBags to show a deleted or renamed folder existed: read its path, embedded times and MFT entry and sequence, then confirm with the $MFT and USN. Florian Amette Mon, 21 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-zip-archives https://www.shellbagsparser.com/en/blog/shellbags-zip-archives How ShellBags record browsing inside ZIP files and other archives in Explorer, what the compressed folder items contain, and how to interpret archive paths. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-usb-network-share-investigation https://www.shellbagsparser.com/en/blog/shellbags-usb-network-share-investigation A fictional case, step by step: ShellBags show a service account browsing a ZIP toolkit, a finance share and a USB drive. What they prove, and what they do not. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-windows-versions https://www.shellbagsparser.com/en/blog/shellbags-windows-versions How ShellBags differ across Windows XP, Vista, 7, 8.1, 10 and 11: hive locations, extension block versions, new root folders and native archive support. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-vs-lnk-jump-lists-recentdocs https://www.shellbagsparser.com/en/blog/shellbags-vs-lnk-jump-lists-recentdocs Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shell-item-format-explained https://www.shellbagsparser.com/en/blog/shell-item-format-explained Byte-level walkthrough of the shell items stored in BagMRU values: class types, file entry items, the 0xBEEF0004 block, MFT references and network items. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-timestamps-explained https://www.shellbagsparser.com/en/blog/shellbags-timestamps-explained Key LastWrite, MRUListEx-derived last interacted, and embedded FAT times: what each ShellBags timestamp proves, with a worked example and the common traps. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/analyze-shellbags-online https://www.shellbagsparser.com/en/blog/analyze-shellbags-online Step-by-step: parse UsrClass.dat and NTUSER.DAT in your browser, read the tree and timeline, triage flagged folders, export CSV or JSON. Nothing uploaded. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/where-are-shellbags-stored https://www.shellbagsparser.com/en/blog/where-are-shellbags-stored ShellBags registry locations in UsrClass.dat and NTUSER.DAT for Windows XP to 11, plus how to collect locked hives with their transaction logs, per user. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.shellbagsparser.com/en/blog/shellbags-forensics-guide https://www.shellbagsparser.com/en/blog/shellbags-forensics-guide What ShellBags are, where Windows stores them, what BagMRU and shell items prove, how to read their timestamps and where the artifact misleads analysts. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT