Lion Cipher Lab
Prove a user opened a folder — even one since deleted — with Windows Shellbags
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Investigations constantly turn on a claim about KNOWLEDGE: 'I never opened that folder', 'I don't know anything about that share', 'I never touched that USB stick'. Execution artifacts like Prefetch and Amcache tell you a program ran or was present; the file-system journal tells you files changed. Neither directly answers 'did this user navigate to this folder and look inside it?' — and that is exactly what shellbags answer. A shellbag is a small convenience feature: when you open a folder in File Explorer, Windows remembers how you like that window — its size and position, the view mode, the…
What you'll learn
- explaining in plain words what the Windows registry, a hive, UsrClass.dat and NTUSER.dat are, and what an MRU (most-recently-used) list is
- defining a shellbag: a per-user record Windows writes to remember a folder's Explorer view settings, and knowing exactly where it lives (UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\BagMRU and \Bags)
- manufacturing ground truth: creating a distinctively named folder, browsing it and a subfolder in File Explorer to write shellbags for your own account, optionally on a USB stick
- understanding the locked-hive constraint honestly — you cannot parse a live, in-use hive file directly — and obtaining a parseable copy three correct ways (SBECmd's live mode, reg save of HKU\<SID>_Classes, or a KAPE/VSS collection)
- parsing the hive with Eric Zimmerman's SBECmd to CSV and reading the reconstructed AbsolutePath, the FirstInteracted / LastInteracted timestamps, and the slot / MRU ordering
- proving the headline property: delete the folder, re-collect and re-parse, and show the shellbag for the now-deleted folder is STILL there — access evidence that outlives the folder
- stating the honest limits out loud: a shellbag proves EXPLORER browsing (not cmd/PowerShell/open-dialog access), so absence is not proof of no access; the times are interaction times, not a first-access clock; it proves the ACCOUNT interacted, not the human; and it proves a folder was viewed, not that a file was opened or copied
- judgment: how shellbags (folder access/knowledge) sit alongside Prefetch and Amcache (execution) and the USN journal and $MFT (file activity) to reconstruct what a user did, and when you would reach for them
Steps in this lab
- From zero: the registry, a hive, and what a shellbag actually is
- Locate the hive on your own machine
- Manufacture ground truth: create a distinctive folder and browse it in Explorer
- The locked-hive problem, and three correct ways to get a parseable copy
- Parse with SBECmd: read the reconstructed path, the interaction times, the MRU order
- The headline: delete the folder, re-parse, and watch the shellbag survive
- The honest negative: what a shellbag does NOT prove
- Judgment: where shellbags fit, and when you reach for them