Back to Details

analyzing-windows-shellbag-artifacts

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Analyzing Windows Shellbag Artifacts

Windows Shellbag取证工件分析

Overview

概述

Shellbags are Windows registry artifacts that track how users interact with folders through Windows Explorer, storing view settings such as icon size, window position, sort order, and view mode. From a forensic perspective, Shellbags provide definitive evidence of folder access -- even folders that no longer exist on the system. When a user browses to a folder via Windows Explorer, the Open/Save dialog, or the Control Panel, a Shellbag entry is created or updated in the user's registry hive. These entries persist after folder deletion, drive disconnection, and even across user profile resets, making them invaluable for proving that a user navigated to specific directories on local drives, USB devices, network shares, or zip archives.
Shellbags是Windows注册表取证工件，用于跟踪用户通过Windows Explorer与文件夹的交互，存储图标大小、窗口位置、排序顺序和视图模式等视图设置。从取证角度来看，Shellbags提供了文件夹访问的确凿证据——即使系统上已不存在这些文件夹。当用户通过Windows Explorer、打开/保存对话框或控制面板浏览到某个文件夹时，会在用户的注册表配置单元中创建或更新Shellbag条目。这些条目在文件夹删除、驱动器断开连接甚至用户配置文件重置后仍然存在，这使得它们对于证明用户浏览过本地驱动器、USB设备、网络共享或zip存档上的特定目录非常宝贵。

When to Use

使用场景

  • When investigating security incidents that require analyzing windows shellbag artifacts
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques
  • 当调查需要分析Windows Shellbag取证工件的安全事件时
  • 当为此领域构建检测规则或威胁狩猎查询时
  • 当SOC分析师需要此类分析的结构化流程时
  • 当验证相关攻击技术的安全监控覆盖范围时

Prerequisites

先决条件

  • Familiarity with digital forensics concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities
  • 熟悉数字取证概念和工具
  • 可访问测试或实验室环境以安全执行操作
  • 安装了所需依赖项的Python 3.8+
  • 任何测试活动的适当授权

Registry Locations

注册表位置

Windows 7/8/10/11

Windows 7/8/10/11

HiveKey PathStores
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagMRUFolder hierarchy tree
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagsView settings per folder
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagMRUDesktop/Explorer shell
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagsAdditional view settings
配置单元键路径存储内容
NTUSER.DATSoftware\Microsoft\Windows\Shell\BagMRU文件夹层次结构树
NTUSER.DATSoftware\Microsoft\Windows\Shell\Bags每个文件夹的视图设置
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagMRU桌面/Explorer外壳
UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\Bags额外的视图设置

BagMRU Structure

BagMRU结构

The BagMRU key contains a hierarchical tree of numbered subkeys representing the directory structure. Each subkey value contains a Shell Item (SHITEMID) binary blob encoding the folder identity:
  • Root (BagMRU): Desktop namespace root
  • BagMRU\0: Typically "My Computer"
  • BagMRU\0\0: First drive (e.g., C:)
  • BagMRU\0\0\0: First subfolder on C:
Each Shell Item contains:
  • Item type (folder, drive, network, zip, control panel)
  • Short name (8.3 format)
  • Long name (Unicode)
  • Creation/modification timestamps
  • MFT entry/sequence for NTFS folders
BagMRU键包含一个编号子键的层次树，代表目录结构。每个子键值包含一个Shell Item（SHITEMID）二进制 blob，编码文件夹标识：
  • 根节点（BagMRU）：桌面命名空间根
  • BagMRU\0：通常为“我的电脑”
  • BagMRU\0\0：第一个驱动器（例如C:）
  • BagMRU\0\0\0：C盘上的第一个子文件夹
每个Shell Item包含：
  • 项类型（文件夹、驱动器、网络、zip、控制面板）
  • 短名称（8.3格式）
  • 长名称（Unicode）
  • 创建/修改时间戳
  • NTFS文件夹的MFT条目/序列

Analysis with EZ Tools

使用EZ工具进行分析

SBECmd (Command Line)

SBECmd（命令行）

powershell
undefined
powershell
undefined

Parse shellbags from a directory of registry hives

Parse shellbags from a directory of registry hives

SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv
SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv

Parse from a live system (requires admin)

Parse from a live system (requires admin)

SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csv
SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csv

Key output columns:

Key output columns:

AbsolutePath - Full reconstructed path

AbsolutePath - Full reconstructed path

CreatedOn - When the folder was first browsed

CreatedOn - When the folder was first browsed

ModifiedOn - When view settings were last changed

ModifiedOn - When view settings were last changed

AccessedOn - Last access timestamp

AccessedOn - Last access timestamp

ShellType - Type of shell item (Directory, Drive, Network, etc.)

ShellType - Type of shell item (Directory, Drive, Network, etc.)

Value - Raw shell item data

Value - Raw shell item data

undefined
undefined

ShellBags Explorer (GUI)

ShellBags Explorer（图形界面）

powershell
undefined
powershell
undefined

Launch GUI tool for interactive analysis

Launch GUI tool for interactive analysis

ShellBagsExplorer.exe
ShellBagsExplorer.exe

Load registry hives: File > Load Hive

Load registry hives: File > Load Hive

Navigate the tree structure to see folder hierarchy

Navigate the tree structure to see folder hierarchy

Right-click entries for detailed shell item properties

Right-click entries for detailed shell item properties

undefined
undefined

Forensic Investigation Scenarios

取证调查场景

Proving USB Device Browsing

证明USB设备浏览行为

text
Shellbag Path: My Computer\E:\Confidential\Project_Files
ShellType: Directory (on removable volume)
CreatedOn: 2025-03-15 09:30:00 UTC

This proves the user navigated to E:\Confidential\Project_Files
via Windows Explorer, even if the USB drive is no longer connected.
The volume letter E: and directory timestamps can be correlated
with USBSTOR and MountPoints2 registry entries.
text
Shellbag Path: My Computer\E:\Confidential\Project_Files
ShellType: Directory (on removable volume)
CreatedOn: 2025-03-15 09:30:00 UTC

This proves the user navigated to E:\Confidential\Project_Files
via Windows Explorer, even if the USB drive is no longer connected.
The volume letter E: and directory timestamps can be correlated
with USBSTOR and MountPoints2 registry entries.

Detecting Network Share Access

检测网络共享访问

text
Shellbag Path: \\FileServer01\Finance\Q4_Reports
ShellType: Network Location
AccessedOn: 2025-02-20 14:15:00 UTC

This proves the user browsed to a network share, even if
the share has been decommissioned or access revoked.
text
Shellbag Path: \\FileServer01\Finance\Q4_Reports
ShellType: Network Location
AccessedOn: 2025-02-20 14:15:00 UTC

This proves the user browsed to a network share, even if
the share has been decommissioned or access revoked.

Identifying Deleted Folder Knowledge

识别已删除文件夹的访问记录

text
Shellbag Path: C:\Users\suspect\Documents\Exfiltration_Staging
ShellType: Directory
CreatedOn: 2025-01-10 08:00:00 UTC

Even though C:\Users\suspect\Documents\Exfiltration_Staging
no longer exists, the Shellbag entry proves the user
created and navigated to this folder.
text
Shellbag Path: C:\Users\suspect\Documents\Exfiltration_Staging
ShellType: Directory
CreatedOn: 2025-01-10 08:00:00 UTC

Even though C:\Users\suspect\Documents\Exfiltration_Staging
no longer exists, the Shellbag entry proves the user
created and navigated to this folder.

Limitations

局限性

  • Shellbags only record folder-level interactions, not individual file access
  • Only created through Windows Explorer shell and Open/Save dialogs
  • Command-line access (cmd, PowerShell) does not generate Shellbag entries
  • Programmatic file access via APIs does not generate Shellbag entries
  • Timestamps may reflect view setting changes, not necessarily folder access
  • Windows may batch-update Shellbag entries during Explorer shutdown
  • Shellbags仅记录文件夹级别的交互，不记录单个文件的访问
  • 仅通过Windows Explorer外壳和打开/保存对话框创建
  • 命令行访问（cmd、PowerShell）不会生成Shellbag条目
  • 通过API进行的程序化文件访问不会生成Shellbag条目
  • 时间戳可能反映视图设置的更改，不一定是文件夹访问时间
  • Windows可能在Explorer关闭期间批量更新Shellbag条目

References

参考资料

Example Output

示例输出

text
$ SBECmd.exe -d "C:\Evidence\Users\jsmith" --csv /analysis/shellbag_output

SBECmd v2.1.0 - ShellBags Explorer (Command Line)
====================================================
Processing hives for user: jsmith
  NTUSER.DAT:  C:\Evidence\Users\jsmith\NTUSER.DAT
  UsrClass.dat: C:\Evidence\Users\jsmith\AppData\Local\Microsoft\Windows\UsrClass.dat

[+] NTUSER.DAT shellbag entries:   456
[+] UsrClass.dat shellbag entries: 1,234
[+] Total shellbag entries:        1,690

--- Folder Access Timeline (Incident Window) ---
Last Accessed (UTC)     | Folder Path                                             | Type        | Access Count
------------------------|---------------------------------------------------------|-------------|-------------
2024-01-15 14:34:05     | C:\Users\jsmith\Downloads                               | File System | 45
2024-01-15 14:36:25     | C:\ProgramData\Updates                                  | File System | 3
2024-01-15 15:05:00     | \\FILESERV01\Finance                                    | Network     | 2
2024-01-15 15:12:30     | \\FILESERV01\Finance\Q4_Reports                          | Network     | 1
2024-01-15 15:30:00     | E:\                                                     | Removable   | 4
2024-01-15 15:30:45     | E:\Backup                                               | Removable   | 3
2024-01-15 15:31:20     | E:\Backup\Corporate_Data                                | Removable   | 2
2024-01-15 16:12:45     | \\FILESERV01\HR\Employees                                | Network     | 1
2024-01-15 16:15:00     | \\FILESERV01\HR\Employees\Records_2024                   | Network     | 1
2024-01-16 02:35:00     | C:\Windows\Temp                                         | File System | 5
2024-01-17 02:44:00     | C:\ProgramData\svc                                     | File System | 2
2024-01-18 01:10:00     | C:\Users\jsmith\AppData\Local\Temp                      | File System | 8

--- Network Share Access ---
  \\FILESERV01\Finance             First: 2023-09-10  Last: 2024-01-15
  \\FILESERV01\Finance\Q4_Reports  First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\FILESERV01\HR\Employees        First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\DC01\SYSVOL                    First: 2023-03-15  Last: 2024-01-16  (anomalous access time)

--- Removable Device Access ---
  E:\ (USB Drive)
    Volume Name:    BACKUP_DRIVE
    First Accessed: 2024-01-15 15:30:00 UTC
    Last Accessed:  2024-01-15 15:45:22 UTC
    Folders Browsed: 3 (E:\, E:\Backup, E:\Backup\Corporate_Data)

--- Deleted/No Longer Existing Paths ---
  C:\ProgramData\Updates\                (folder deleted, shellbag persists)
  C:\ProgramData\svc\                    (folder deleted, shellbag persists)
  C:\Windows\Temp\tools\                 (folder deleted, shellbag persists)

Summary:
  Total unique folders accessed:  1,690
  Network shares accessed:        4 (2 newly accessed during incident)
  Removable media:                1 USB device (data staging suspected)
  Deleted folder evidence:        3 paths (anti-forensics indicator)
  CSV exported to:                /analysis/shellbag_output/
text
$ SBECmd.exe -d "C:\Evidence\Users\jsmith" --csv /analysis/shellbag_output

SBECmd v2.1.0 - ShellBags Explorer (Command Line)
====================================================
Processing hives for user: jsmith
  NTUSER.DAT:  C:\Evidence\Users\jsmith\NTUSER.DAT
  UsrClass.dat: C:\Evidence\Users\jsmith\AppData\Local\Microsoft\Windows\UsrClass.dat

[+] NTUSER.DAT shellbag entries:   456
[+] UsrClass.dat shellbag entries: 1,234
[+] Total shellbag entries:        1,690

--- Folder Access Timeline (Incident Window) ---
Last Accessed (UTC)     | Folder Path                                             | Type        | Access Count
------------------------|---------------------------------------------------------|-------------|-------------
2024-01-15 14:34:05     | C:\Users\jsmith\Downloads                               | File System | 45
2024-01-15 14:36:25     | C:\ProgramData\Updates                                  | File System | 3
2024-01-15 15:05:00     | \\FILESERV01\Finance                                    | Network     | 2
2024-01-15 15:12:30     | \\FILESERV01\Finance\Q4_Reports                          | Network     | 1
2024-01-15 15:30:00     | E:\                                                     | Removable   | 4
2024-01-15 15:30:45     | E:\Backup                                               | Removable   | 3
2024-01-15 15:31:20     | E:\Backup\Corporate_Data                                | Removable   | 2
2024-01-15 16:12:45     | \\FILESERV01\HR\Employees                                | Network     | 1
2024-01-15 16:15:00     | \\FILESERV01\HR\Employees\Records_2024                   | Network     | 1
2024-01-16 02:35:00     | C:\Windows\Temp                                         | File System | 5
2024-01-17 02:44:00     | C:\ProgramData\svc                                     | File System | 2
2024-01-18 01:10:00     | C:\Users\jsmith\AppData\Local\Temp                      | File System | 8

--- Network Share Access ---
  \\FILESERV01\Finance             First: 2023-09-10  Last: 2024-01-15
  \\FILESERV01\Finance\Q4_Reports  First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\FILESERV01\HR\Employees        First: 2024-01-15  Last: 2024-01-15  (NEW)
  \\DC01\SYSVOL                    First: 2023-03-15  Last: 2024-01-16  (anomalous access time)

--- Removable Device Access ---
  E:\ (USB Drive)
    Volume Name:    BACKUP_DRIVE
    First Accessed: 2024-01-15 15:30:00 UTC
    Last Accessed:  2024-01-15 15:45:22 UTC
    Folders Browsed: 3 (E:\, E:\Backup, E:\Backup\Corporate_Data)

--- Deleted/No Longer Existing Paths ---
  C:\ProgramData\Updates\                (folder deleted, shellbag persists)
  C:\ProgramData\svc\                    (folder deleted, shellbag persists)
  C:\Windows\Temp\tools\                 (folder deleted, shellbag persists)

Summary:
  Total unique folders accessed:  1,690
  Network shares accessed:        4 (2 newly accessed during incident)
  Removable media:                1 USB device (data staging suspected)
  Deleted folder evidence:        3 paths (anti-forensics indicator)
  CSV exported to:                /analysis/shellbag_output/