DFIR tools and techniques for tracing user footprints through Shellbags 

This report explains Windows Shellbags as persistent registry artifacts that record user folder navigation, including on deleted folders, network shares, and external devices, and shows how to analyze them with tools like Shellbags Explorer by interpreting BagMRU/Bags structures, node slots, and timestamps. It clarifies limitations (no file-level access, reliance on Explorer interactions, and bypass via command line, PowerShell, or browser file dialogs) and advises correlating with $MFT, USN Journal, Prefetch, SRUM, Jump Lists, and RecentDocs to build robust activity timelines for DFIR.