Can Shellbags track deleted folders?

Yes, Shellbag entries persist in the registry even after the corresponding folder has been deleted, making them vital for identifying destroyed evidence or staging areas.

Do command-line actions create Shellbags?

No, Shellbags are specifically generated by GUI interactions through Windows Explorer or Open/Save dialogs; actions in CMD or PowerShell do not create these artifacts.

How do Shellbags help in USB forensics?

They record paths accessed on removable drives, allowing investigators to prove a user navigated specific folders on a USB device even if the device is no longer connected to the system.

What are Windows Shellbags?

Shellbags are registry keys that store user preferences for folder views, providing a forensic trail of every directory a user has opened in Windows Explorer, including timestamps.

Which tools are recommended for Shellbag analysis?

This skill focuses on using Eric Zimmerman's EZ Tools, specifically SBECmd for high-speed command-line parsing and ShellBags Explorer for interactive GUI-based analysis.

Windows Shellbag Forensic Analysis

Name: Windows Shellbag Forensic Analysis
Author: mukul975

bymukul975

•

4,121

•

セキュリティとテスト

Analyzes Windows Shellbag registry artifacts to reconstruct folder browsing history and detect access to deleted or external storage.

This skill provides structured guidance and implementation patterns for forensic analysis of Windows Shellbag artifacts, which track user interaction with folders via Windows Explorer. It enables security analysts to prove folder access even for directories that have been deleted or reside on disconnected USB drives and network shares. By utilizing tools like SBECmd and ShellBags Explorer, the skill assists in building timelines of user activity, identifying data staging, and uncovering evidence of anti-forensic attempts during incident response and digital forensic investigations.

主な機能

01Reconstruction of folder browsing history from BagMRU and Bags registry keys

02Automated parsing guidance for SBECmd and ShellBags Explorer

03Detection of access to removable media (USB) and network shares

04Identification of interaction with deleted folders and zip archives

054,121 GitHub stars

06Correlation of Shellbag data with NIST CSF and forensic frameworks

ユースケース

01Proving user knowledge of specific directories even after they have been deleted

02Reconstructing user activity on a compromised workstation during a breach

03Investigating insider threats or data exfiltration via removable media

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-windows-shellbag-artifacts

For use in Claude.ai and ChatGPT

主な機能

01Reconstruction of folder browsing history from BagMRU and Bags registry keys

02Automated parsing guidance for SBECmd and ShellBags Explorer

03Detection of access to removable media (USB) and network shares

04Identification of interaction with deleted folders and zip archives

054,121 GitHub stars

06Correlation of Shellbag data with NIST CSF and forensic frameworks

ユースケース

01Proving user knowledge of specific directories even after they have been deleted

02Reconstructing user activity on a compromised workstation during a breach

03Investigating insider threats or data exfiltration via removable media

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-windows-shellbag-artifacts

For use in Claude.ai and ChatGPT