Analyzing Windows Shellbag Artifacts
FreeReconstruct folder access history from Windows registry.
Free · Opens the source repo
What Analyzing Windows Shellbag Artifacts does
The Analyzing Windows Shellbag Artifacts skill provides tools for digital forensic investigations by analyzing Shellbag entries in the Windows registry. Shellbags are artifacts that track user interactions with folders in Windows Explorer, capturing details like view settings and folder access timestamps. This skill allows investigators to extract and analyze these entries using SBECmd and Shellbags Explorer, enabling the reconstruction of a user's folder browsing activity, even for directories that have been deleted.
When a user navigates to a folder, a Shellbag entry is created or updated in the registry, which persists even after the folder is deleted or the drive is disconnected. This makes Shellbags a critical resource for digital forensics and incident response, as they provide definitive evidence of folder access across local drives, removable media, and network shares. The skill includes command-line and GUI tools for parsing and visualizing Shellbag data, making it easier for analysts to understand user behavior and access patterns.
This skill is particularly useful for security analysts, digital forensic investigators, and incident response teams who need to validate user activity and investigate potential security incidents. By leveraging Shellbag data, users can build detection rules, conduct threat hunting, and ensure comprehensive coverage of security monitoring strategies. The skill emphasizes the importance of understanding the underlying registry structures and how to extract meaningful insights from them.
While the skill is powerful, users should be aware of its limitations. Shellbags only capture folder-level interactions and do not record individual file access. Additionally, not all access methods generate Shellbag entries, which can affect the completeness of the analysis. Users should ensure they have the appropriate environment and authorization for conducting these investigations.
When to use it
Use this skill when investigating security incidents or validating user activity in digital forensics.
When not to use it
Avoid this skill for analyzing individual file access or when access methods do not generate Shellbag entries.
What you can build with it
Investigating a Security Incident
Use this skill to analyze Shellbag artifacts during a security incident investigation to prove user folder access.
Building Detection Rules
Leverage Shellbag data to create detection rules for monitoring user interactions with sensitive directories.
Validating User Activity
Utilize Shellbags to validate user activity in compliance audits or during forensic investigations.
How to install Analyzing Windows Shellbag Artifacts
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-windows-shellbag-artifacts --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Windows Shellbag Artifacts
Overview
Shellbags are Windows registry artifacts that track how users interact with folders through Windows Explorer, storing view settings such as icon size, window position, sort order, and view mode. From a forensic perspective, Shellbags provide definitive evidence of folder access -- even folders that no longer exist on the system. When a user browses to a folder via Windows Explorer, the Open/Save dialog, or the Control Panel, a Shellbag entry is created or updated in the user's registry hive. These entries persist after folder deletion, drive disconnection, and even across user profile resets, making them invaluable for proving that a user navigated to specific directories on local drives, USB devices, network shares, or zip archives.
When to Use
- When investigating security incidents that require analyzing windows shellbag artifacts
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with digital forensics concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Registry Locations
Windows 7/8/10/11
| Hive | Key Path | Stores |
|---|---|---|
| NTUSER.DAT | Software\Microsoft\Windows\Shell\BagMRU | Folder hierarchy tree |
| NTUSER.DAT | Software\Microsoft\Windows\Shell\Bags | View settings per folder |
| UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\BagMRU | Desktop/Explorer shell |
| UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\Bags | Additional view settings |
BagMRU Structure
The BagMRU key contains a hierarchical tree of numbered subkeys representing the directory structure. Each subkey value contains a Shell Item (SHITEMID) binary blob encoding the folder identity:
- Root (BagMRU): Desktop namespace root
- BagMRU\0: Typically "My Computer"
- BagMRU\0\0: First drive (e.g., C:)
- BagMRU\0\0\0: First subfolder on C:
Each Shell Item contains:
- Item type (folder, drive, network, zip, control panel)
- Short name (8.3 format)
- Long name (Unicode)
- Creation/modification timestamps
- MFT entry/sequence for NTFS folders
Analysis with EZ Tools
SBECmd (Command Line)
# Parse shellbags from a directory of registry hives
SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv
# Parse from a live system (requires admin)
SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csv
# Key output columns:
# AbsolutePath - Full reconstructed path
# CreatedOn - When the folder was first browsed
# ModifiedOn - When view settings were last changed
# AccessedOn - Last access timestamp
# ShellType - Type of shell item (Directory, Drive, Network, etc.)
# Value - Raw shell item data
ShellBags Explorer (GUI)
# Launch GUI tool for interactive analysis
ShellBagsExplorer.exe
# Load registry hives: File > Load Hive
# Navigate the tree structure to see folder hierarchy
# Right-click entries for detailed shell item properties
Forensic Investigation Scenarios
Proving USB Device Browsing
Shellbag Path: My Computer\E:\Confidential\Project_Files
ShellType: Directory (on removable volume)
CreatedOn: 2025-03-15 09:30:00 UTC
This proves the user navigated to E:\Confidential\Project_Files
via Windows Explorer, even if the USB drive is no longer connected.
The volume letter E: and directory timestamps can be correlated
with USBSTOR and MountPoints2 registry entries.
Detecting Network Share Access
Shellbag Path: \\FileServer01\Finance\Q4_Reports
ShellType: Network Location
AccessedOn: 2025-02-20 14:15:00 UTC
This proves the user browsed to a network share, even if
the share has been decommissioned or access revoked.
Identifying Deleted Folder Knowledge
Shellbag Path: C:\Users\suspect\Documents\Exfiltration_Staging
ShellType: Directory
CreatedOn: 2025-01-10 08:00:00 UTC
Even though C:\Users\suspect\Documents\Exfiltration_Staging
no longer exists, the Shellbag entry proves the user
created and navigated to this folder.
Limitations
- Shellbags only record folder-level interactions, not individual file access
- Only created through Windows Explorer shell and Open/Save dialogs
- Command-line access (cmd, PowerShell) does not generate Shellbag entries
- Programmatic file access via APIs does not generate Shellbag entries
- Timestamps may reflect view setting changes, not necessarily folder access
- Windows may batch-update Shellbag entries during Explorer shutdown
References
- Shellbags Forensic Analysis 2025: https://www.cybertriage.com/blog/shellbags-forensic-analysis-2025/
- SANS Shellbag Forensics: https://www.sans.org/blog/computer-forensic-artifacts-windows-7-shellbags
- Magnet Forensics Shellbag Analysis: https://www.magnetforensics.com/blog/forensic-analysis-of-windows-shellbags/
- ShellBags Explorer: https://ericzimmerman.github.io/
Example Output
$ SBECmd.exe -d "C:\Evidence\Users\jsmith" --csv /analysis/shellbag_output
SBECmd v2.1.0 - ShellBags Explorer (Command Line)
====================================================
Processing hives for user: jsmith
NTUSER.DAT: C:\Evidence\Users\jsmith\NTUSER.DAT
UsrClass.dat: C:\Evidence\Users\jsmith\AppData\Local\Microsoft\Windows\UsrClass.dat
[+] NTUSER.DAT shellbag entries: 456
[+] UsrClass.dat shellbag entries: 1,234
[+] Total shellbag entries: 1,690
--- Folder Access Timeline (Incident Window) ---
Last Accessed (UTC) | Folder Path | Type | Access Count
------------------------|---------------------------------------------------------|-------------|-------------
2024-01-15 14:34:05 | C:\Users\jsmith\Downloads | File System | 45
2024-01-15 14:36:25 | C:\ProgramData\Updates | File System | 3
2024-01-15 15:05:00 | \\FILESERV01\Finance | Network | 2
2024-01-15 15:12:30 | \\FILESERV01\Finance\Q4_Reports | Network | 1
2024-01-15 15:30:00 | E:\ | Removable | 4
2024-01-15 15:30:45 | E:\Backup | Removable | 3
2024-01-15 15:31:20 | E:\Backup\Corporate_Data | Removable | 2
2024-01-15 16:12:45 | \\FILESERV01\HR\Employees | Network | 1
2024-01-15 16:15:00 | \\FILESERV01\HR\Employees\Records_2024 | Network | 1
2024-01-16 02:35:00 | C:\Windows\Temp | File System | 5
2024-01-17 02:44:00 | C:\ProgramData\svc | File System | 2
2024-01-18 01:10:00 | C:\Users\jsmith\AppData\Local\Temp | File System | 8
--- Network Share Access ---
\\FILESERV01\Finance First: 2023-09-10 Last: 2024-01-15
\\FILESERV01\Finance\Q4_Reports First: 2024-01-15 Last: 2024-01-15 (NEW)
\\FILESERV01\HR\Employees First: 2024-01-15 Last: 2024-01-15 (NEW)
\\DC01\SYSVOL First: 2023-03-15 Last: 2024-01-16 (anomalous access time)
--- Removable Device Access ---
E:\ (USB Drive)
Volume Name: BACKUP_DRIVE
First Accessed: 2024-01-15 15:30:00 UTC
Last Accessed: 2024-01-15 15:45:22 UTC
Folders Browsed: 3 (E:\, E:\Backup, E:\Backup\Corporate_Data)
--- Deleted/No Longer Existing Paths ---
C:\ProgramData\Updates\ (folder deleted, shellbag persists)
C:\ProgramData\svc\ (folder deleted, shellbag persists)
C:\Windows\Temp\tools\ (folder deleted, shellbag persists)
Summary:
Total unique folders accessed: 1,690
Network shares accessed: 4 (2 newly accessed during incident)
Removable media: 1 USB device (data staging suspected)
Deleted folder evidence: 3 paths (anti-forensics indicator)
CSV exported to: /analysis/shellbag_output/
Frequently asked questions about Analyzing Windows Shellbag Artifacts
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.