educationFeb 2, 202612:03pending
Course 21 - Digital Forensics: Windows Shellbags | Episode 4: Shellbag Forensics: Tracking USB Device History and Artifact Validation
About this episode
In this lesson, you’ll learn about:
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
- USB Forensics Using Shellbag Artifacts
- How Windows Shellbags can be leveraged to reconstruct user interaction with removable media.
- Why Shellbags are valuable for determining whether files were copied to or from USB devices, even when the media is no longer connected.
- Initial Evidence Generation and Collection
- Creating controlled forensic artifacts by moving test files onto a FAT16-formatted USB drive.
- Exporting relevant registry hives (such as USRCLASS.DAT) using FTK Imager.
- Loading these hives into Shellbag Explorer for structured analysis.
- Understanding File System Timestamp Behavior
- Recognizing FAT16 limitations, where Last Accessed timestamps record only the date, not the time.
- Interpreting Created timestamps as the moment files or folders were moved onto the USB device.
- Understanding why Modified timestamps often remain unchanged during copy or move operations.
- Shellbag Data Merging and Ghost Artifacts
- Learning how Windows may merge Shellbag data when a USB device is reformatted, renamed, or reused.
- Understanding how previously accessed folders can still appear in Shellbag Explorer due to reuse of the same drive letter or volume identifiers.
- Identifying “ghost” directories and avoiding false assumptions about current device contents.
- Handling Multiple Removable Devices
- Observing how Windows assigns new drive letters (e.g., E:, then F:) when multiple USB devices are connected.
- Using Last Write Time values to infer when a USB device was inserted or when its folder view preferences were modified.
- Forensic Validation and Reporting
- Evaluating whether timestamps and folder structures logically align with expected user behavior.
- Understanding why investigators must not rely solely on automated tool output.
- Emphasizing manual validation to prevent misinterpretation caused by merged or residual Shellbag data.
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
Get every episode summarized
Each time CyberCode Academy publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from CyberCode Academy
Course 42 - Mobile Malware Analysis Fundamentals | Episode 9: Mastering Basic St...
CyberCode Academy
Sep 5, 202621:16completed
Course 42 - Mobile Malware Analysis Fundamentals | Episode 8: Static Analysis of...
CyberCode Academy
Sep 4, 202621:15completed
Course 42 - Mobile Malware Analysis Fundamentals | Episode 7: Malware Tools and...
CyberCode Academy
Sep 3, 202621:03completed
Course 42 - Mobile Malware Analysis Fundamentals | Episode 6: The Evolution and...
CyberCode Academy
Sep 2, 202622:42pending