ShellBags Windows注册表分析工具
MicrosoftWindowsusesasetofRegistrykeysknownas“shellbags”tomaintainthesize,view,icon,andpositionofafolderwhenusingExplorer.Thesekeysareusefultoaforensicinvestigator.Shellbagspersistinformationfordirectoriesevenafterthedirectoryisremoved,whichmeansthattheycanbeusedtoenumeratepastmo