Extract and analyze persistent Windows Registry artifacts to reconstruct user activity, folder navigation, and lateral movement timelines.
v2.4.1 | Lic: Enterprise Forensic
Choose a disk image to begin Shellbag extraction and analysis.
Windows Shellbags are highly persistent registry keys that track your folder interactions. They act as a breadcrumbs trail allowing forensic analysts to reconstruct user activity, even after folders are deleted or devices are removed.
Tracks the "Navigation Path". It tells you WHERE a user went and in WHAT ORDER.
Absolute location on disk
First accessed / Last written
Frequency of interaction
Physical origin of data
Advanced threat actors often clear Event Logs but forget Shellbags. Look for: