Windows forensics ShellBags related experiments: The specific registry location is: Record the information of the folder recently accessed through the resource manager: USRCLASS.DAT: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\ BagMRU USRCLASS.DAT: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Log folder information accessed from the desktop: NTUSER.DAT: HKCU\Software\Microsoft\Windows\Shell\BagMRU NTUSER.DAT: HKCU \Software\Microsoft\Windows\Shell\Bags There are some other registry locations: (There may be some additional registry entries due to different system versions) NTUSER.DAT: HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU NTUSER.DAT : HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags USRCLASS.DAT: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\ShellNoRoam\BagMRU USRCLASS.DAT: HKCU\Software\Classes\Local Settings\Software\ Microsoft\Windows\ShellNoRoam\Bags USRCLASS.DAT: HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU USRCLASS.DAT: HKCU\Software\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\ Shell\Bags It can be found that the data of ShellBags mainly exists in two registry keys, namely BagMRU and Bags. BagMRU: used to record the folder name and folder path Bags: record the view configuration of the folder, such as window size, location,View mode information such as sorting. 
x3, Structure Analysis of ShellBags
When a user browses the file system through Windows Explorer and opens a folder for the first time, the system will create a ShellBags entry. Each folder has a number, and the numbering starts from 0. When opening a subpath, an entry is added to the right of the corresponding ShellBags entry and assigned a number that increments by one.
ShellBag entries are updated immediately when the user operates on the folder. This means that the corresponding registry key last modified time may also be the last time the folder was manipulated.
BagMRU key value: the root directory of
ShellBags, and its subkeys contain ShellBags sub-entries and sub-directories. Consists of digit numbers 0,1,2....
and their binary type value item (value name) records the path of the folder and the long and short name of the folder. Therefore, we can restore the directory structure of the file system according to this structure.
We can use Nirsoft's registry modification monitoring tool and Shell bags view tool to combine the registry to view its creation and change process.
First create a shellbagstest folder under the C drive The content of the value item "11" of the 0 key records the name of the folder,and corresponding to its subkey "11".
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\11 The value of the NodeSlot key is the HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags key ID (the child key name of the Bags key).
also has a MRUListEx which records which folder was last accessed. According to this, the access order of the folder can be parsed. When there is no subfolder under the corresponding folder or the subfolder has not been accessed, its value is ff ff ff ff. When we enter this folder and add a subfolder, check the registry modification again: You can see that multiple key-value items have been added, and MRUListEx has also changed. Where "1" is the subfolder "subdir". And "0" is "New Folder" when creating a new folder. Regarding the MRUListEx value item , it records the access sequence of the folder. Every 4 bytes records the numerical number of a folder. When a new access record is added, the original record is moved to the right. Take the example just now: The leftmost 0x00000001 indicates that the folder with the numerical serial number "1" under the shellbagstest folder was recently accessed, that is, the subdir folder. If you add another folder subdir2: MRUListEX, the value becomes the following value: The MRUListEX of its parent key will also be updated: Bags key value: Bags key value consists of sub-keys named by numbers,The numerical number of each subkey corresponds to a specific folder. It contains a Shell key for storing view configuration information related to the folder, such as location, size, sorting method, etc. Therefore, we can obtain the corresponding numerical sequence number of a specific folder under the Bags key according to the BagMRU key value, and then locate the corresponding subkey in the Bags key, and then view the view configuration information of the folder. For example, the folder we just created: x4, forensic battle 15-12:45) plugged into his computer. Podrick claims that some files/folders on his computer have changed. He thinks Theon did it. Podrick wants us to help find out which files have changed. Mainly focus on the emptied Projects folder on the desktop.
Commits when the Projects folder is recreated by Theon. The files provided to us by
include NTUSER.DAT and UsrClass.dat.
We can use ShellBags parsing tools, such as Shell Bag Explorer: https://f001.backblazeb2.com/file/EricZimmermanTools/ShellBagsExplorer.zip
Use the tool to load the USRCLASS.DAT file to find the Projects folder, you can see the creation of the folder The time is 12:41:26, which is exactly when Podrick is not at the computer. Combined with previous investigations, it can be determined that this time is the time when the folder was recreated. x3, Structure Analysis of ShellBags
When a user browses the file system through Windows Explorer and opens a folder for the first time, the system will create a ShellBags entry. Each folder has a number, and the numbering starts from 0. When opening a subpath, an entry is added to the right of the corresponding ShellBags entry and assigned a number that increments by one.
ShellBag entries are updated immediately when the user operates on the folder. This means that the corresponding registry key last modified time may also be the last time the folder was manipulated.
BagMRU key value: the root directory of
ShellBags, and its subkeys contain ShellBags sub-entries and sub-directories. Consists of digit numbers 0,1,2....
and their binary type value item (value name) records the path of the folder and the long and short name of the folder. Therefore, we can restore the directory structure of the file system according to this structure.
We can use Nirsoft's registry modification monitoring tool and Shell bags view tool to combine the registry to view its creation and change process.
First create a shellbagstest folder under the C drive The content of the value item "11" of the 0 key records the name of the folder and corresponds to its subkey "11".
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\11 The value of the NodeSlot key is the HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags key ID (the child key name of the Bags key).
also has a MRUListEx which records which folder was last accessed. According to this, the access order of the folder can be parsed. When there is no subfolder under the corresponding folder or the subfolder has not been accessed, its value is ff ff ff ff. When we enter this folder and add a subfolder, check the registry modification again: You can see that multiple key-value items have been added, and MRUListEx has also changed. Where "1" is the subfolder "subdir". And "0" is "New Folder" when creating a new folder. Regarding the MRUListEx value item , it records the access sequence of the folder. Every 4 bytes records the numerical number of a folder. When a new access record is added, the original record is moved to the right. Take the example just now: The leftmost 0x00000001 indicates that the folder with the numerical serial number "1" under the shellbagstest folder was recently accessed, that is, the subdir folder. If you add another folder subdir2: MRUListEX, the value will become the following value: The MRUListEX of its parent key will also be updated: Bags key value: Bags key value is composed of sub-keys named by numbers, and the number of each sub-key corresponds to a specific key folder.It contains a Shell key for storing view configuration information related to the folder, such as location, size, sorting method, etc. Therefore, we can obtain the corresponding numerical sequence number of a specific folder under the Bags key according to the BagMRU key value, and then locate the corresponding subkey in the Bags key, and then view the view configuration information of the folder. For example, the folder we just created: x4, forensic battle 15-12:45) plugged into his computer. Podrick claims that some files/folders on his computer have changed. He thinks Theon did it. Podrick wants us to help find out which files have changed. Mainly focus on the emptied Projects folder on the desktop.
Commits when the Projects folder is recreated by Theon. The files provided to us by
include NTUSER.DAT and UsrClass.dat.
We can use ShellBags parsing tools, such as Shell Bag Explorer: https://f001.backblazeb2.com/file/EricZimmermanTools/ShellBagsExplorer.zip
Use the tool to load the USRCLASS.DAT file to find the Projects folder, you can see the creation of the folder The time is 12:41:26, which is exactly when Podrick is not at the computer. Combined with previous investigations, it can be determined that this time is the time when the folder was recreated.
