Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even after the folders are deleted. Use when reconstructing a user's folder access history or proving access to a since-removed directory in DFIR work.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifactsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-windows-shellbag-artifacts -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-windows-shellbag-artifactsgh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-windows-shellbag-artifactsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-windows-shellbag-artifacts ~/.claude/skills/analyzing-windows-shellbag-artifacts # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-windows-shellbag-artifacts ~/.agents/skills/analyzing-windows-shellbag-artifacts # Codex, Cursor, Gemini CLI, Copilot, OpenCode