IT Forensics – Windows
Forensic analysis of ShellBags – reconstructing folder access and user activity
ShellBags are among the most valuable artefacts in a Windows forensic investigation. They are created when Windows Explorer is used and contain information about folders that have been opened by a user. Even if folders have subsequently been deleted or storage media removed, ShellBag entries may still be present under certain circumstances and provide important clues about previous user activity.
In the context of a professional IT forensic investigation, ShellBags are never assessed in isolation. Only by analysing them in conjunction with other artefacts – such as the Windows Registry, LNK files, jump lists, the Master File Table (MFT) or the USN Journal – is it possible to carry out a reliable technical reconstruction of events.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
We analyse ShellBag entries, reconstruct folder accesses and evaluate the information obtained in conjunction with other Windows artefacts. This often enables us to place user activities in a chronological context and document them in a traceable manner.
Typical areas of application
This is how a ShellBag forensic analysis is carried out
Once a forensic image has been created, the relevant registry sections in which Windows stores ShellBag information are analysed. The results are then correlated with other digital evidence and fully documented to enable an objective technical assessment.
Why are ShellBags so important?
ShellBags often provide clues as to which folders a user has opened or browsed. As such, they can make an important contribution to reconstructing user activities. However, as with all forensic artefacts, their significance only becomes apparent through the comprehensive analysis of all relevant digital traces.
Frequently Asked Questions
LanCologne – Windows Forensics in Cologne
Do you need a professional analysis of ShellBags or other Windows artefacts? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of complex Windows systems.
Related to this topic
- Forensic analysis of Amcache – evidence of programmes and system activity
- Forensic analysis of ShimCache (AppCompatCache) – evidence of applications that have been run
- Forensic analysis of SRUM – Tracking system and network activity
- Forensic analysis of Windows Timeline – tracing user activities chronologically