Tool and Usage
Shellbags is a script written in Python to parse the Windows Registry file. It extract related information from directories browsed by Explorer.
Why this tool?
Typically this tool will be used to gather information from a compromised system or to track traces from a system to find evidence. Shellbags can provide some insight on browsed directories on the system via Explorer on Microsoft Windows systems.
How it works
The shellbags script is provided the path to a raw Windows Registry hive (NTUSER.DAT). It is then parsed on the system of the forensic specialist.
Usage and audience
This tool is categorized as a digital forensics tool.
shellbags is commonly used for digital forensics. Target users for this tool are forensic specialists and pentesters.
- + The source code of this software is available
Author and Maintainers
Shellbags is under development by Willi Ballenthin.
Support operating systems
Shellbags is known to work on Linux and Microsoft Windows.