BergssonForensics.
Menu
← Back to catalogue
User activity

ShellBags

ShellBags preserve Windows shell view settings and directory-related shell items. They can expose folder or device context after a folder disappears, but do not universally record file reads or exact visits.

Listen to the full guide

Download MP32 min · AI narration

Useful for

Support that a directory was represented in retained shell/profile state.

Important limit

Prove the user read every file inside a folder.

Location & availability

User UsrClass.dat and NTUSER.DAT shell BagMRU/Bags structures

Shell version, profile use and parser support affect what can be reconstructed.

Fields to examine

  • Shell item hierarchy and reconstructed directory path.
  • Item metadata and key LastWrite with their distinct meanings.
  • User hive and source key path.

What it can establish

  • Support that a directory was represented in retained shell/profile state.

What it cannot prove

  • Prove the user read every file inside a folder.
  • Assign an exact first/last visit from every available timestamp.

Use it in a screenshare

  1. Acquire the relevant user hives and identify the profile being examined.
  2. Parse with a ShellBags-aware tool, keeping hierarchy and raw key references.
  3. Correlate a meaningful directory with LNK, Jump Lists or device records. Explain unresolved virtual folders and ambiguous times.

Worked example

A deleted mods folder appears in reconstructed ShellBags. That helps locate historical directory context. It does not identify which mod files were inside at match time; those need independent records or retained contents.

Cross-check the finding

  • LNK shortcuts →Support a stored shortcut-to-target relationship.
  • Jump Lists →Support an application/destination association in the retained data.
  • $MFT →Support the presence and recorded metadata of a particular file record.

Sources

Choose another artefact →