Windows Artifacts: ShellBags, ADS, LNK, Hibernation and Slack

ShellBags retain shell-item and view-state information associated with a user profile. Relevant structures can occur in NTUSER.DAT or UsrClass.dat, with different paths and behaviour by version. Identify the actual hive and BagMRU/Bags structures rather than assume every system writes the same records to both locations.

A retained record can supply a folder name, hierarchy or associated device information after the original storage is unavailable. Its existence supports a scoped interaction or stored-shell-state inference, not a complete list of every folder opened or a guarantee that each contained file was viewed.

ShellBags Explorer and SBECmd can reconstruct supported shell-item structures. Preserve the raw hive and available supporting logs, note the tool version and inspect unsupported or partially decoded items. Parsed labels such as first or last interaction need their actual derivation understood.

Embedded target timestamps, key last-write times and MRU ordering are different observations. They do not necessarily provide the exact moment or number of visits. Compare relevant source structures and corroborating evidence before assigning a folder visit to a person or a precise time.

An NTFS file can have an unnamed default data stream and additional named streams. A path such as file.txt:streamname refers to a named stream. Ordinary file-size displays may describe only the default content, while other views enumerate streams explicitly.

Zone.Identifier is a common stream associated with origin-zone information, including Mark of the Web. Generation and retention depend on the application, transfer route, filesystem and policy; not every downloaded file has one. A familiar stream name can also be copied or modified.

Use suitable enumeration on a protected analysis source, such as dir /R, listing modes of Sysinternals Streams, or a forensic tool that preserves named streams. Verify scope and access. Do not use stream-deletion options on evidence as part of ordinary examination.

Classify stream content from actual bytes and context, not a fixed small-text-versus-large-binary rule. Allocated size can also reflect cluster rounding, compression or sparse storage; a size discrepancy alone does not prove a hidden payload.

Extract with a method that preserves the intended bytes. Text redirection or default text decoding can change binary content. Record the full stream name, source reference, extraction method and integrity data, and distinguish the extracted derivative from the original file’s default stream.

LNK files support locating and opening targets. Applications and Windows can create them in Recent locations, while users or software can create or copy them elsewhere. Identify their source; no single directory records every access.

The Shell Link format contains a header and optional structures. Depending on flags and contents, these can include stored target times and size, path information, volume information and link-tracking data. Missing fields are not necessarily parser failures; some structures may legitimately be absent.

Keep the shortcut’s own filesystem timestamps separate from target-related values stored inside it. A stored target time is not automatically the time the shortcut was created, resolved or opened. Retained metadata can also outlive the target or be copied from another context.

An optional TrackerDataBlock contains MachineID and GUID-related tracking values. Microsoft defines MachineID as the NetBIOS name of the machine where the target was last known to reside. It is not a universal record of which person or computer created the shortcut.

Some GUID representations can contain a node-like identifier, but a parsed MAC-related value does not independently establish a unique adapter, shortcut creator or operator. Assess the actual structure, generation context, copied artefacts and independent records.

LECmd can parse supported shortcut fields. Preserve the original LNK, source path, parser version and warnings, and compare critical conclusions with the specification. A target path or volume serial is a lead for comparison, not automatic proof that one seized USB device was used by one person.

Live acquisition, hibernation data and paged-out data have different scopes. Live collection itself spans an interval; hibernation-related files can represent an earlier state or a limited subset. Record the OS version, file type, acquisition context and supported parser.

Windows full and reduced hibernation/Fast Startup configurations do not retain identical information. A hiberfil.sys file is not automatically a complete image of all user-process memory, and a filename alone does not establish its actual time or completeness.

Tool support must be verified for the format and platform. Do not assume every Volatility version directly accepts every Windows hibernation format or that a conversion makes every missing page available. Keep conversion logs and distinguish unavailable memory from a negative content finding.

pagefile.sys and swapfile.sys can retain selected paged or suspended-state material depending on configuration and activity. Some information may never be paged or may be protected, overwritten or unavailable. String extraction does not reconstruct every process, token or conversation.

bulk_extractor and other supported tools can identify candidate structured material in acquired bytes. Findings need source offsets, encoding and context. A candidate key-like string is not proof of a working key, and a memory fragment does not identify who entered it.

Logical length, allocation and unused storage are distinct. Under an explicitly nonresident, uncompressed allocation of one 4,096-byte cluster, a 100-byte file leaves 3,996 bytes beyond its logical end. A resident NTFS file or a different allocation model does not satisfy those assumptions.

File slack lies within a file’s relevant allocation. Unallocated clusters are a separate source; calling all of them drive slack obscures that distinction. Either can contain zeros or residual material, and neither guarantees recovery of previous content.

The Sleuth Kit documents blkls -s for slack extraction and separate selection of unallocated blocks. Verify the filesystem, offset, image type and actual tool version. An ordinary logical file export often omits allocation residue, although a specialised logical collection can explicitly include additional material.

Preserve block and file references for recovered material. $MFT, $LogFile and $UsnJrnl do not provide a complete historical ledger naming every former owner of every cluster. A fragment can remain relevant while its prior filename or exact deposition time remains unknown.

Volume Shadow Copy may expose earlier volume views when configured, retained and acquired. Snapshot time, scope and application consistency need assessment. A snapshot is not guaranteed to exist for an incident date or to preserve all material that changed between snapshots.

For eligible deletions on relevant Windows versions, Recycle Bin metadata and retained contents can appear as related $I and $R records beneath a user-associated directory. Parse the actual version, pair what survives and report missing components. Some deletion routes bypass the bin.

A user-associated SID, a deletion record and a retained file each address different questions. Their combination does not independently establish who physically acted, why the deletion occurred or that every deleted file is represented.

Begin with the examination question and a verified source. Collect appropriate hives and supporting logs, shortcut files, named streams, memory-related files and retained snapshots without assuming a single compound target covers every relevant location.

Use compatible parsers and retain versions, definitions, options, warnings and source references. A CSV is a derivative that needs a traceable relationship to the original bytes. Broad triage can guide targeted examination but is not a complete forensic conclusion.

Compare artefacts with attention to clock basis, copied records, shared generation mechanisms and source independence. Preserve differences and negative findings as well as apparent matches. Avoid assigning a fixed processing duration or national laboratory policy without a defined source.

For the complementary registry, log and execution sources, see Windows Registry, Event Logs and Prefetch. Legal authority and admissibility depend on the jurisdiction; technical records should explain the actual work performed.