How to Use Shellbag Analyzer + Cleaner for Forensic & Privacy Cleanup
Overview
Shellbags record folder view and access information in Windows registry and can reveal user activity. Shellbag Analyzer + Cleaner is a tool that helps investigators extract, analyze, and selectively remove shellbag artifacts for forensic review or privacy cleanup. This guide walks through preparing, extracting artifacts, analyzing results, and safely cleaning shellbags.
1. Prepare your environment
- Isolation: Work on a forensic image or a copy of the original system to avoid modifying original evidence.
- Tools: Download Shellbag Analyzer + Cleaner from a trusted source (official project page or reputable repository). Also have a HEX/registry viewer and a write-blocking setup if working with physical drives.
- Permissions: Run the tool with administrator privileges on the analysis machine.
- Documentation: Open a case log to record steps, timestamps, and hashes of any images or exported files.
2. Acquire data
- Image the target system: Create a forensic image (E01, DD) of the target drive using industry tools (FTK Imager, dd).
- Mount or extract registry hives: From the image, extract the NTUSER.DAT (per-user), UsrClass.dat (if present), and SYSTEM hives for the relevant profiles. Confirm integrity by hashing.
3. Install and launch Shellbag Analyzer + Cleaner
- Install: Follow the included instructions. No internet connection is required for analysis; consider offline use for sensitive cases.
- Launch: Start the program as Administrator. If you prefer a portable run, execute from the extracted folder.
4. Load registry hives or live system data
- Offline analysis (preferred for forensics):
- Use the tool’s option to load registry hives (point to NTUSER.DAT / UsrClass.dat files).
- Verify the tool parsed entries successfully; it should list folders, timestamps, and path details.
- Live system use (privacy cleanup):
- The tool can read the live registry to find current shellbag entries. Be aware this modifies the live system if you perform cleaning—avoid in forensic contexts.
5. Analyze extracted shellbag artifacts
- Review paths and timestamps: Examine paths, last modified/accessed timestamps, and associated SID/user. Shellbags can show previously accessed folders, even those on external media.
- Identify anomalies: Look for:
- References to external drives or network shares not currently present.
- Folder names suggesting deleted or hidden directories.
- Timestamp sequences that conflict with other logs.
- Correlate with other artifacts: Match shellbag entries to file system timeline, event logs, prefetch, and USB device history for stronger conclusions.
6. Use filtering and reporting features
- Filters: Narrow results by user SID, date range, or path patterns to focus investigations.
- Export: Export results (CSV/HTML) for reporting and chain-of-custody. Include hashes of original hives and the exported report in your case log.
- Documentation tip: Capture screenshots of key entries and note the exact hive and offset for each artifact.
7. Cleaning shellbags (privacy cleanup)
- Decide scope: Determine whether to remove specific entries or perform a broad cleanup. For privacy, target only entries that expose sensitive locations.
- Backup first: Always back up the hive(s) before any cleaning operation.
- Use the tool’s cleaner: Select entries and use the cleaner to remove them. The tool should offer selective deletion—use that to avoid unintended data loss.
- Verify changes: After cleaning, reload the hive(s) and confirm the targeted entries are removed. Re-hash the hive backups and note changes in your log.
8. Forensic best practices and cautions
- Never clean original evidence: Do not run cleaning operations on original devices if preserving evidence for legal proceedings.
- Chain-of-custody: Maintain strict documentation of who accessed images, when, and what actions were taken.
- Record all modifications: If changes are necessary during an investigation (rare), document and justify them thoroughly.
- Cross-validate findings: Use multiple artifact sources before drawing conclusions about user activity.
9. Example workflow (concise)
- Image drive → hash image.
- Extract NTUSER.DAT and UsrClass.dat → hash hives.
- Load hives in Shellbag Analyzer + Cleaner.
- Filter by user and date → export suspicious entries.
- Correlate with event logs and USB history.
- Report findings; if performing privacy cleanup, backup hives and run cleaner on non-evidence systems.
10. Further resources
- Consult official documentation and changelogs for the latest parsing behavior.
- Use established forensic references on Windows artifacts for deeper interpretation of shellbag semantics.
If you want, I can produce a shorter quick-reference checklist or a ready-to-print step-by-step evidence-handling checklist.