Course 21 - Digital Forensics: Windows Shellbags | Episode 5: Shellbags Forensics: Validating Network Drive Activity | CyberCode Academy

In this lesson, you’ll learn about:

Validating Network Drive Activity with Shellbags
- How Windows Shellbags act as a silent witness for user interaction with network shares and mapped drives.
- Why UsrClass.dat is a critical artifact for proving access to remote resources, even when permissions are restricted.
Recording Remote Folder Access
- How accessing a mapped network drive (e.g., Z:) generates Shellbag entries.
- Capturing exact remote folder paths (such as administrative or restricted directories) that a user navigated to.
- Demonstrating that Shellbags records navigation, not just file creation or modification.
Timestamp Behavior in Network Shellbags
- Understanding how remote MAC times are copied and stored locally:
  - Last Accessed Time: Often reflects the precise moment the user viewed or entered the network folder.
  - Last Written Time: May indicate when the network drive was first connected or when folder view settings were changed.
  - Created Time: Represents the state of the folder metadata at the moment it was first recorded in Shellbags.
- Recognizing that all timestamps must be interpreted in UTC and converted to local time for reporting.
Event Reconstruction and Attribution
- Reconstructing timelines that show who accessed which network location and when.
- Correlating Shellbag entries with other evidence to confirm intentional user interaction rather than background system activity.
- Differentiating between mere drive connection and active navigation into specific subfolders.
Investigative and Evidentiary Value
- Using Shellbag evidence to prove file awareness and knowledge, not just theoretical access.
- Supporting cases involving unauthorized access, insider threat activity, or data exfiltration.
- Reinforcing why Shellbags are especially powerful when files no longer exist or access logs are unavailable.

By the end of this episode, you’ll be able to confidently analyze Shellbag artifacts related to network drives, interpret their timestamps accurately, and use them to demonstrate user knowledge and interaction with remote file systems in a forensic investigation.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 21 - Digital Forensics: Windows Shellbags | Episode 5: Shellbags Forensics: Validating Network Drive Activity

About this episode

Get every episode summarized

More from CyberCode Academy

Course 42 - Mobile Malware Analysis Fundamentals | Episode 13: Designing and Arc...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 12: Dynamic Analysis...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 10: The Essentials of...