CG
SkillsAnalyzing Windows Shellbag Artifacts
Start Free
Back to Skills Library
Digital Forensics🟡 Intermediate

Analyzing Windows Shellbag Artifacts

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

3 min read5 code examples

Analyzing Windows Shellbag Artifacts

Overview

Shellbags are Windows registry artifacts that track how users interact with folders through Windows Explorer, storing view settings such as icon size, window position, sort order, and view mode. From a forensic perspective, Shellbags provide definitive evidence of folder access -- even folders that no longer exist on the system. When a user browses to a folder via Windows Explorer, the Open/Save dialog, or the Control Panel, a Shellbag entry is created or updated in the user's registry hive. These entries persist after folder deletion, drive disconnection, and even across user profile resets, making them invaluable for proving that a user navigated to specific directories on local drives, USB devices, network shares, or zip archives.

Registry Locations

Windows 7/8/10/11

HiveKey PathStores
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagMRUFolder hierarchy tree
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagsView settings per folder
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagMRUDesktop/Explorer shell
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagsAdditional view settings

BagMRU Structure

The BagMRU key contains a hierarchical tree of numbered subkeys representing the directory structure. Each subkey value contains a Shell Item (SHITEMID) binary blob encoding the folder identity:

  • Root (BagMRU): Desktop namespace root
  • BagMRU\0: Typically "My Computer"
  • BagMRU\0\0: First drive (e.g., C:)
  • BagMRU\0\0\0: First subfolder on C:

Each Shell Item contains:

  • Item type (folder, drive, network, zip, control panel)
  • Short name (8.3 format)
  • Long name (Unicode)
  • Creation/modification timestamps
  • MFT entry/sequence for NTFS folders

Analysis with EZ Tools

SBECmd (Command Line)

# Parse shellbags from a directory of registry hives
SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv

# Parse from a live system (requires admin)
SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csv

# Key output columns:
# AbsolutePath - Full reconstructed path
# CreatedOn - When the folder was first browsed
# ModifiedOn - When view settings were last changed
# AccessedOn - Last access timestamp
# ShellType - Type of shell item (Directory, Drive, Network, etc.)
# Value - Raw shell item data

ShellBags Explorer (GUI)

# Launch GUI tool for interactive analysis
ShellBagsExplorer.exe

# Load registry hives: File > Load Hive
# Navigate the tree structure to see folder hierarchy
# Right-click entries for detailed shell item properties

Forensic Investigation Scenarios

Proving USB Device Browsing

Shellbag Path: My Computer\E:\Confidential\Project_Files
ShellType: Directory (on removable volume)
CreatedOn: 2025-03-15 09:30:00 UTC

This proves the user navigated to E:\Confidential\Project_Files
via Windows Explorer, even if the USB drive is no longer connected.
The volume letter E: and directory timestamps can be correlated
with USBSTOR and MountPoints2 registry entries.

Detecting Network Share Access

Shellbag Path: \\FileServer01\Finance\Q4_Reports
ShellType: Network Location
AccessedOn: 2025-02-20 14:15:00 UTC

This proves the user browsed to a network share, even if
the share has been decommissioned or access revoked.

Identifying Deleted Folder Knowledge

Shellbag Path: C:\Users\suspect\Documents\Exfiltration_Staging
ShellType: Directory
CreatedOn: 2025-01-10 08:00:00 UTC

Even though C:\Users\suspect\Documents\Exfiltration_Staging
no longer exists, the Shellbag entry proves the user
created and navigated to this folder.

Limitations

  • Shellbags only record folder-level interactions, not individual file access
  • Only created through Windows Explorer shell and Open/Save dialogs
  • Command-line access (cmd, PowerShell) does not generate Shellbag entries
  • Programmatic file access via APIs does not generate Shellbag entries
  • Timestamps may reflect view setting changes, not necessarily folder access
  • Windows may batch-update Shellbag entries during Explorer shutdown

Verification Criteria

Confirm successful execution by validating:

  • [ ] All prerequisite tools and access requirements are satisfied
  • [ ] Each workflow step completed without errors
  • [ ] Output matches expected format and contains expected data
  • [ ] No security warnings or misconfigurations detected
  • [ ] Results are documented and evidence is preserved for audit

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

  • SOC 2: CC7.3 (Incident Identification), CC7.4 (Incident Response)
  • ISO 27001: A.16.1 (Security Incident Management), A.12.4 (Logging)
  • NIST 800-53: AU-6 (Audit Review), IR-4 (Incident Handling), AU-9 (Audit Protection)
  • NIST CSF: RS.AN (Analysis), RS.RP (Response Planning)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add analyzing-windows-shellbag-artifacts

# Or load dynamically via MCP
grc.load_skill("analyzing-windows-shellbag-artifacts")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

  • SHA-256 chain hashing ensures no step can be modified after execution
  • Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
  • Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.

References

  • Shellbags Forensic Analysis 2025: https://www.cybertriage.com/blog/shellbags-forensic-analysis-2025/
  • SANS Shellbag Forensics: https://www.sans.org/blog/computer-forensic-artifacts-windows-7-shellbags
  • Magnet Forensics Shellbag Analysis: https://www.magnetforensics.com/blog/forensic-analysis-of-windows-shellbags/
  • ShellBags Explorer: https://ericzimmerman.github.io/

Use with Claw GRC Agents

This skill is fully compatible with Claw GRC's autonomous agent system. Deploy it to any registered agent via MCP, and every execution will be logged in the tamper-evident audit trail.

// Load this skill in your agent
npx claw-grc skills add analyzing-windows-shellbag-artifacts
// Or via MCP
grc.load_skill("analyzing-windows-shellbag-artifacts")

Tags

shellbagswindows-registrysbecmdshellbags-explorerfolder-accessuser-activityremovable-medianetwork-shares

Related Skills

Digital Forensics

Analyzing LNK File and Jump List Artifacts

4m·intermediate
Digital Forensics

Analyzing USB Device Connection History

6m·intermediate
Digital Forensics

Analyzing Windows Registry for Artifacts

5m·intermediate
Digital Forensics

Acquiring Disk Image with dd and dcfldd

4m·intermediate
Digital Forensics

Analyzing Browser Forensics with Hindsight

3m·intermediate
Digital Forensics

Analyzing Disk Image with Autopsy

6m·intermediate

Skill Details

Domain
Digital Forensics
Difficulty
intermediate
Read Time
3 min
Code Examples
5

On This Page

OverviewRegistry LocationsAnalysis with EZ ToolsForensic Investigation ScenariosLimitationsReferencesVerification CriteriaCompliance Framework MappingDeploying This Skill with Claw GRC

Deploy This Skill

Add this skill to your Claw GRC agent and start automating.

Get Started Free →