Tag Archives: Windows ShellBag Parser

sbag – TZWorks Windows ShellBag Parser

sbag is a Windows registry parser that targets the Shellbag subkeys to pull useful directory and file artifacts to help identify user activity.