ShellBags & directory context
Reconstruct user-specific directory context while distinguishing folder navigation from file execution.
Question & scope
ShellBags can preserve information about directories encountered through the Windows shell. During a game examination, they may provide context for a removed client folder, an external drive, or a different instance location. These records relate to shell presentation and directory context; they are not a complete record of opening every file inside a folder.
Collect the relevant user registry hives, including UsrClass.dat where applicable, with supporting transaction logs. Preserve the Windows profile association. A parser may reconstruct a directory hierarchy from multiple records, so retain the records and reconstruction context instead of relying solely on the final displayed path.
What to collect
| Source | Retain and examine |
|---|---|
| User hives | Relevant NTUSER.DAT and UsrClass.dat copies with supporting logs. |
| Profile identity | SID, profile path, Windows build, and acquisition time. |
| Directory records | Parsed hierarchy, shell-item information, and source key paths. |
| Supporting paths | LNK targets, Jump Lists, filesystem records, and game instance configuration. |
Examination workflow
- Locate the hives for the profile actually examined rather than assuming the first profile is the active player context.
- Parse collected copies using a documented ShellBags implementation and record its version.
- Follow the reconstructed directory hierarchy and retain any unresolved or incomplete segments.
- Compare external-volume or removed-folder references with device, shortcut, and filesystem evidence.
- Report which directory context survived and which further claim would require separate evidence.
Interpretation & false positives
Directory context does not establish that a particular executable ran. It may help explain where to look, but the contents of a directory can change after the record is created. Different timestamp fields may originate from shell items or registry keys and describe different things. Do not collapse them into a single last-opened time without verifying the field semantics.
A reference to removable storage is not a complete history of transfers. An absent ShellBag is not proof that a folder was never visited. Collection coverage, application behavior, profile selection, and artifact retention all limit the result.
Worked scenario
A removed folder name appears in reconstructed shell context and a shortcut points to a similarly named executable. This supports a path lead. Compare volume and object information before treating the names as the same location, then look for independent execution-related records. The directory record itself should remain a directory observation in the report.
Report checklist
- The profile and both relevant hive sources are considered.
- Reconstructed paths identify unresolved segments.
- Each timestamp is reported with its originating field.
- Directory context is not presented as executable use.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.