Skip to content
Get packs

Windows Shellbag Forensics

Reconstructs folder browsing history on Windows from registry Shellbag artifacts using SBECmd

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Teaches the agent how to examine Windows registry data that records which folders a user opened in Windows Explorer, including folders on USB drives and network shares and folders that have since been deleted. The agent can explain how to run the SBECmd and ShellBags Explorer tools, interpret the output columns, and write up findings with the caveats the skill lists. It also includes two Python helper scripts that can parse exported CSV output into a summary JSON report, and an agent script that parses registry hives directly.

Great for

  • Digital forensics and incident response analysts reconstructing a user's folder access history
  • Investigators who need to show a user browsed to a removed directory or a USB or network location
  • Students learning Windows forensic artifacts

Skip it if

  • Live production systems where the user has not been authorized for forensic examination, since reading registry hives of other users raises privacy and legal issues
  • Proving that individual files were opened or copied, because Shellbags only record folder-level interaction
  • Activity done through command line or API, which the skill notes does not create Shellbag entries

Try asking

  • “Analyze the NTUSER.DAT and UsrClass.dat hives from this evidence folder and list folders reached from removable drives”
  • “Use SBECmd to export shellbag entries from this hive directory to CSV and summarize network share access”
  • “Explain whether a deleted folder named Exfiltration_Staging could be shown to have been browsed by this user”
  • “Run process.py on the SBECmd CSV output and produce the USB and network path summary”
Step-by-step guide: how to use Windows Shellbag ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-windows-shellbag-artifacts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-windows-shellbag-artifacts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-windows-shellbag-artifacts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run analysis on copies of hive files in a lab, not on original evidence, and record hashes for chain of custody
  • Corroborate Shellbag findings with USBSTOR, MountPoints2, Prefetch or event logs, because the skill notes timestamps may reflect view changes rather than access
  • Review the scripts before running them, since agent.py reads registry hives and process.py writes report files to a chosen output directory

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.