Guide · Agent skill
How to use the Windows Shellbag Forensics agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the analyzing-windows-shellbag-artifacts agent skill, a set of instructions and scripts that teaches an AI agent to examine Windows Shellbag registry data. Shellbags record which folders a user opened in Windows Explorer, including folders on USB drives, network shares and folders that have since been deleted. By the end you will know what the skill does, how to install it, how to ask for it in plain language, and what limits to respect when you report findings.
Windows Shellbag Forensicsmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder for one project.
- 2Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 3Confirm the requirements. Check that you have Python 3.8 or newer and, for parsing, SBECmd and ShellBags Explorer on Windows. Make sure your hive files come from an authorized source.
- 4Ask in plain language. Describe the folder question, the hive files you have and whether the data is exported or live. Mention the incident window if you have one.
- 5Parse and review the output. Run SBECmd to export CSV, or let the agent guide you through ShellBags Explorer. Review AbsolutePath, timestamps and ShellType before drawing conclusions.
- 6Write up with caveats. Use the report template and state the limits: folder-level evidence only, no file-level proof, and timestamps that may reflect view changes.
What the skill makes the agent do
Shellbags are Windows registry artifacts that track how a user interacts with folders through Windows Explorer. The skill's source describes them as storing view settings such as icon size, window position, sort order and view mode, and says they are created or updated when a user browses via Windows Explorer, the Open/Save dialog or the Control Panel.
With this skill, the agent can explain how to run the SBECmd and ShellBags Explorer tools from Eric Zimmerman, interpret their output columns, and write up findings with the caveats the skill lists. It also includes two Python helper scripts that parse exported CSV output into a summary JSON report, and an agent script that parses registry hives directly.
- Explains where Shellbag data lives in NTUSER.DAT and UsrClass.dat
- Interprets SBECmd and ShellBags Explorer output columns
- Helps reconstruct a folder access timeline
- Drafts a write-up that includes the skill's stated limitations
How to install the skill
Download the ZIP for this skill from this page. Then either unzip it into ~/.claude/skills/ to make it available across your projects, or unzip it into a project's .claude/skills/ folder to limit it to that project.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload
How to trigger the skill with natural requests
You do not need special syntax. Describe the task in plain words that match the skill's description, which covers reconstructing a user's folder access history and proving access to a since-removed directory in DFIR work. The skill is meant for requests about folder browsing evidence, not general Windows questions.
Include the context the agent needs: which hive files you have, whether the data is from an exported image or a live system, and what question you are answering.
- Reconstruct which folders user jsmith browsed during the incident window from the NTUSER.DAT and UsrClass.dat hives.
- Can we prove the user navigated to a folder on a USB drive that is no longer connected?
- Summarise the SBECmd CSV export into a JSON report of folder access.
What you need before you start
The skill's source lists these requirements. Shellbag parsing is done with Windows tools, so you will need a Windows machine for SBECmd and ShellBags Explorer, even though the helper scripts are Python.
Registry hive files should come from a forensic image or an authorized lab system. The source says to use a test or lab environment for safe execution and to have appropriate authorization for any testing.
- Python 3.8 or newer
- SBECmd and ShellBags Explorer from Eric Zimmerman's tools (Windows)
- Optional Python libraries: python-registry or regipy
- Registry hive files from a forensic image or an authorized lab system
- Familiarity with digital forensics concepts
Run SBECmd and read the output
SBECmd is the command-line parser. The skill's examples process a directory of hives and export to CSV. A live-system example is also given, which the source notes requires admin rights.
The key output columns are AbsolutePath, CreatedOn, ModifiedOn, AccessedOn, ShellType and Value. ShellBags Explorer is the GUI option: load hives with File > Load Hive, then navigate the tree to see the folder hierarchy.
- AbsolutePath: full reconstructed path
- CreatedOn: when the folder was first browsed
- ModifiedOn: when view settings were last changed
- AccessedOn: last access timestamp
- ShellType: type of shell item such as Directory, Drive or Network
- Value: raw shell item data
SBECmd.exe -d "C:\Evidence\Registry" --csv C:\Output --csvf shellbags.csv
SBECmd.exe --live --csv C:\Output --csvf live_shellbags.csvUse the helper scripts
The skill ships with scripts/process.py, which parses exported CSV output into a summary JSON report, and scripts/agent.py, which parses registry hives directly. The source does not list command-line flags for either script, so check each file's own usage text before running it.
The source also includes a report template at assets/template.md with sections for case info, folder access summary, USB device access and network share access. Use it to structure your write-up.
- scripts/process.py: CSV export to summary JSON
- scripts/agent.py: direct hive parsing
- assets/template.md: report layout
Safety notes on scripts and network use
This skill runs scripts, so review the files in the ZIP before you run them on evidence. The listing states that it runs scripts and does not use the network.
Reading registry hives of other users raises privacy and legal issues. Confirm you are authorized before examining a live system or a user's profile.
- Runs scripts: yes
- Uses network: no
- Work on copies of evidence where possible
- Confirm written authorization before examining another user's registry data
Know the limits before you report
Shellbags record folder-level interaction only. They do not prove that individual files were opened or copied. Command-line and API activity does not create Shellbag entries, and timestamps may reflect view setting changes rather than access.
Windows may batch-update Shellbag entries during Explorer shutdown, so timing can be imprecise. The skill suggests correlating findings with other artifacts such as USBSTOR and MountPoints2 entries, and with MFT and LNK file timestamps.
- Folder-level only, not file-level proof
- No entries for cmd, PowerShell or API access
- Timestamps can reflect view changes
- Correlate with other artifacts before concluding
What people use it for
- Reconstructing a user's folder access timeline during an incident window
- Showing that a user browsed to a directory on a removed USB drive
- Showing that a user navigated to a network share that has since been decommissioned
- Teaching students how Windows Shellbag artifacts are structured and read
Frequently asked questions
How do I install the windows shellbag forensics agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What do I need to run this skill?
The source lists Python 3.8 or newer, SBECmd and ShellBags Explorer from Eric Zimmerman's tools on Windows, optional python-registry or regipy libraries, and registry hive files from a forensic image or an authorized lab system.
Is the Shellbag forensics skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. The SBECmd and ShellBags Explorer tools are separate Eric Zimmerman tools, so check their own licence terms before use.
Can Shellbags prove a user opened a specific file?
No. The skill states that Shellbags only record folder-level interactions, not individual file access. Use them to show folder navigation and correlate with other artifacts for file-level questions.
Does the skill work with PowerShell or command-line activity?
No. The source says command-line access through cmd or PowerShell, and programmatic file access via APIs, do not generate Shellbag entries, so the skill cannot show that kind of activity.
What is the difference between SBECmd and ShellBags Explorer?
SBECmd is a command-line parser that can export CSV, while ShellBags Explorer is a GUI where you load hives with File > Load Hive and browse the folder tree. The skill covers both.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a DFIR analyst, investigator or student who needs to reconstruct folder browsing history from Windows registry hives that you are authorized to examine. Pick something else if you need file-level proof of access, evidence of command-line activity, or live examination of systems without authorization.
Download the skill