sbag – TZWorks Windows ShellBag Parser

sbag is a Windows registry parser that targets the Shellbag subkeys to pull useful directory and file artifacts to help identify user activity. There are binaries available for Windows, Linux and Mac OS-X. The Windows version allows one to parse hives resident from a live system.

sbag - TZWorks Windows ShellBag Parser
sbag – TZWorks Windows ShellBag Parser

ShellBag entries may contain information about user activity on the system:

  • Names and paths of folders opened on the workstation (even if the folder has been deleted)
  • Detailed information about the time stamp, creation time, time of change, access time.

As background, the ShellBag information is a set of subkeys in a user registry hive (eg. ntuser.dat and usrclass.dat files) used by the Windows operating system to track user window viewing preferences. It does this by storing various Windows Explorer settings that relates to dimensions, settings, etc. This allows one to reopen the same folder at a later time with the settings from the previous time. Each user will have separate preferences for folders, and therefore, these settings are stored in the appropriate user hive.

Since the ShellBag subkeys store various metadata on how Windows Explorer items were arranged, and since they are recorded for each user, from a computer forensics standpoint, one can parse the data and pull out various pieces of information that relate to user interaction.

You can read more and download this tool over here: