Home Videos Shellbag Forensics

Shellbag Forensics

0
0
1,195

As a continuation of the “Introduction to Windows Forensics” series, this video by Richard Davis introduces Shellbags. Have you ever customized the folder view settings within any folder in Windows Explorer? This could be anything from changing the sort order, to changing the view type from icons, to list view, to detail view, changing what columns are visible, or even changing the size of the window. If so, when you’ve returned to that folder at a later date, you’ve probably seen that the customizations remained. That information is stored within “Shellbags”.

Why do digital forensics examiners care about folder view settings, and how could this possibly be of forensic interest? Watch this video and find out!

Load More Related Articles
  • RDP Event Log Forensics

    As a continuation of the “Introduction to Windows Forensics” series, this epis…
  • Windows Process Genealogy

    As an incident responder, one of the things you need to be able to quickly do when looking…
  • Event Log Forensics with Log Parser

    As a continuation of the “Introduction to Windows Forensics” series, this vide…
Load More In Videos

Leave a Reply

Your email address will not be published. Required fields are marked *