ShellBags Forensics: The Complete Guide for Investigators
What ShellBags are, where Windows stores them, what BagMRU and shell items prove, how to read their timestamps and where the artifact misleads analysts.
Series
ShellBags fundamentals
5 posts in this series. Read them in order or jump to any one.
- ShellBags Forensics: The Complete Guide for Investigators
What ShellBags are, where Windows stores them, what BagMRU and shell items prove, how to read their timestamps and where the artifact misleads analysts.
- Where Are ShellBags Stored? Locations and Collection
ShellBags registry locations in UsrClass.dat and NTUSER.DAT for Windows XP to 11, plus how to collect locked hives with their transaction logs, per user.
- ShellBags Timestamps Explained: What Each Time Means
Key LastWrite, MRUListEx-derived last interacted, and embedded FAT times: what each ShellBags timestamp proves, with a worked example and the common traps.
- Shell Item Format Explained: Inside a ShellBag Entry
Byte-level walkthrough of the shell items stored in BagMRU values: class types, file entry items, the 0xBEEF0004 block, MFT references and network items.
- ShellBags on Windows 11, 10, 7 and XP: What Changed
How ShellBags differ across Windows XP, Vista, 7, 8.1, 10 and 11: hive locations, extension block versions, new root folders and native archive support.
All posts in this series
Where Are ShellBags Stored? Locations and Collection
ShellBags registry locations in UsrClass.dat and NTUSER.DAT for Windows XP to 11, plus how to collect locked hives with their transaction logs, per user.
ShellBags Timestamps Explained: What Each Time Means
Key LastWrite, MRUListEx-derived last interacted, and embedded FAT times: what each ShellBags timestamp proves, with a worked example and the common traps.
Shell Item Format Explained: Inside a ShellBag Entry
Byte-level walkthrough of the shell items stored in BagMRU values: class types, file entry items, the 0xBEEF0004 block, MFT references and network items.
ShellBags on Windows 11, 10, 7 and XP: What Changed
How ShellBags differ across Windows XP, Vista, 7, 8.1, 10 and 11: hive locations, extension block versions, new root folders and native archive support.