Shellbags Forensic Analysis 2025

Cyber Triage guide to Shellbags, the folder-viewing artifact.

Describes how Windows records folder access preferences in the registry, which can prove a user browsed specific folders, including deleted or removable media paths.

Why it's useful

Evidence of folder access that survives deletion.

Category: DFIR
Pricing: Free
Tags: dfir, windows, registry, artifacts
Link: www.cybertriage.com