Shellbags can be used to answer the difficult questions …

Shellbags can be used to answer the difficult questions of data enumeration in intrusion cases, identify the contents of long gone removable devices, and show the contents of previously mounted encrypted volumes. Information persists for deleted folders, providing an invaluable reference for items no longer part of the file system.

Computer Forensic Artifacts: Windows 7 Shellbags

(View on gamamb.tumblr.com)

You may also like...