How to Analyze ShellBags Online With a Browser Parser
Step-by-step: parse UsrClass.dat and NTUSER.DAT in your browser, read the tree and timeline, triage flagged folders, export CSV or JSON. Nothing uploaded.
Series
ShellBags tools and comparisons
3 posts in this series. Read them in order or jump to any one.
- How to Analyze ShellBags Online With a Browser Parser
Step-by-step: parse UsrClass.dat and NTUSER.DAT in your browser, read the tree and timeline, triage flagged folders, export CSV or JSON. Nothing uploaded.
- ShellBags vs LNK Files, Jump Lists and RecentDocs
Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots.
- ShellBags Explorer Alternatives: SBECmd, RegRipper & More
A fair comparison of ShellBags tools: ShellBags Explorer, SBECmd, RegRipper, Velociraptor, shellbags.py, Volatility and a browser parser. Strengths, gaps.
All posts in this series
ShellBags vs LNK Files, Jump Lists and RecentDocs
Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots.
ShellBags Explorer Alternatives: SBECmd, RegRipper & More
A fair comparison of ShellBags tools: ShellBags Explorer, SBECmd, RegRipper, Velociraptor, shellbags.py, Volatility and a browser parser. Strengths, gaps.