665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-windows-shellbag-artifacts

Reconstruct user folder navigation history from Windows ShellBag registry artifacts.

Updated Aug 27, 2026

Search Tags:#dfir #windows-registry #user-activity #shellbags #sbecmd #shellbags-explorer #folder-access

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-windows-shellbag-artifacts

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-windows-shellbag-artifacts
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-windows-shellbag-artifacts
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-windows-shellbag-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Registry, regipy, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Shellbag registry artifacts capture user folder navigation and view settings, enabling investigators to reconstruct directory access history even after items have been deleted or moved.

Core Features & Use Cases

Parse BagMRU and Bags entries from NTUSER.DAT and UsrClass.dat to reconstruct folder access histories.
Identify access to network shares and removable media to correlate with incidents.
Integrate SBECmd outputs with ShellBags Explorer timelines for evidence-based investigations.

Quick Start

Run SBECmd to export shellbag data from the target hives, then analyze the CSV to generate a folder-access timeline.

Frequently Asked Questions about analyzing-windows-shellbag-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reconstruct folder access history from Windows Shellbag artifacts?▼

You can reconstruct folder access history by parsing BagMRU and Bags entries from NTUSER.DAT and UsrClass.dat registry hives to expose directory navigation paths and view settings.

What are Shellbags in digital forensics and what problem do they solve?▼

Shellbags are Windows registry artifacts that capture user folder navigation and view settings. They enable investigators to reconstruct directory access history even after items have been deleted or moved.

How do I use SBECmd to analyze Shellbags for an incident response investigation?▼

Run SBECmd to export shellbag data from target registry hives, then analyze the exported CSV data to generate a timeline of folder access for your incident response workflow.

Can I detect access to network shares and removable media using Windows registry artifacts?▼

Yes, parsing Shellbag registry artifacts allows you to identify user access to network shares and removable media, which you can then correlate with incident timelines and MFT metadata.

Does this Shellbag analysis approach work with Registry and regipy dependencies?▼

Yes, the Skill leverages the Registry and regipy dependencies to parse BagMRU and Bags entries from NTUSER.DAT and UsrClass.dat for folder access reconstruction.

How do I integrate ShellBags Explorer timelines with SBECmd outputs?▼

After running SBECmd to export shellbag data into CSV format, you can import and analyze the parsed folder-access timeline data within ShellBags Explorer for evidence-based investigations.

Related Skills

Explore More Data & Analytics Skills→

market-opportunity-analyzer

Estimate TAM, SAM, and SOM with competitive landscape analysis.

LeoWSY-hashblue

dfir

Correlates EVTX, PCAP, memory, and MFT artifacts to reconstruct Windows incident timelines.

sungaoxiang-backend

evidence-household-handler

Extract household registry image data into structured card_features slots.

forensics

Extract hidden data and forensic artifacts from files using standard tools.