Is anyone including shellbag artifacts in their analysis of Windows systems?

If so, what tool(s) are you using?

How are you analyzing/including/interpreting the DOSDate time stamps?

Thanks.  

Yes.

Regripper and TZWorks sbag.

Using the steps under Timestamp Verification on TZWorks site.  

- BitHead

Regripper and TZWorks sbag.

Over the lists/sites that I've posted this question to, you're the first one to mention RegRipper.

Have you had any issues with regards to validation of either tool, or between the two?

- BitHead

Using the steps under Timestamp Verification on TZWorks site.

That's great for verification. How are you incorporating those values into your analysis?

Thanks.  

I'm using following tools:
- TZWorks sbag
- RegRipper
- MiTeC Windows Registry Analyzer v1.5.2 (ShellBags + StreamMRUs)
- Nir Sorfer's ShellBagsView
and excellent EnPack, 42 LLC Bag Parser, by Yogesh Khatri (ShellBags + StreamMRUs)

My tools of choice are TZWorks sbag + 42LLC Bag Parser. I do like 42LLC Bag Parser for its ability to parse all relevant registry hive files in a single pass (located in all users' profiles, System Restore and so on), very detailed report and nice, Explorer-like form of presenting results (you can also export the results into Excel file for further processing, e.g. to compare and cross-verify with sbag results or to follow manual verification according to TZWorks).

Greg  

Greg,

Thanks.

How are you analyzing/including/interpreting the DOSDate time stamps?

Also, do you have any thoughts on the output of TZWorks sbag.exe vs. the RegRipper plugin?

Thanks.  

I'm using Mitec, TZWorks but not RR so much. TZ is my tool of the moment. I've been a shellbag addict since 2005 - never really understood why everyone doesn't do it on every job.

I like the CSV output from TZWorks.

I hadn't heard of the ENpack that Greg mentions but I'll be hunting it down.  

Ben,

Thanks.

How are you analyzing/including/interpreting the DOSDate time stamps?

Also, what have you done to validate the TZWorks tool?