Which Windows Artifact Best Reveals Deleted Folders and Mounted Drives?
Short answer
C Parse the BagMRU and Bags ShellBag registry keys with SBag to recover deleted folders, mounted-drive paths, and Explorer actions.
Question
Key Takeaways
The exam tests whether you can separate ShellBag registry evidence from LNK and Jump List artifacts; the trap is picking a familiar tool name paired with the wrong artifact.
Windows ShellBags, stored in the BagMRU and Bags registry keys, record Explorer folder views and can preserve evidence of deleted directories, mounted drives, and suspect actions. This page establishes that parsing those keys with SBag is the correct answer (C), not analyzing LNK files with ShellBags Explorer.
Common mistake: Most learners choose A because ShellBags Explorer sounds authoritative, but it is designed for ShellBags, not LNK files, and the question’s deleted-directory and mounted-drive emphasis points to BagMRU/Bags parsing with SBag.
Expert Analysis
Why the Answer Is Correct
ShellBags are user-specific registry structures stored under BagMRU and Bags; they record how folders were viewed in Windows Explorer, including folder names, paths, and references to removable or network locations. Because those records can outlive the folder itself, they are useful for reconstructing deleted directories and previously mounted drives. SBag is purpose-built to parse BagMRU and Bags, so option C directly matches the artifact to the forensic tool. This is the strongest fit for the question’s request for recent suspect actions involving deleted directories/files and mounted drives.
Why the Other Options Are Wrong
Option A is internally mismatched: LNK files are shortcut artifacts, while ShellBags Explorer is a ShellBag parser, not an LNK analyzer; LNKs may show file targets but do not provide the same folder-view and deleted-directory history. Option B confuses Jump Lists, which live in AutomaticDestinations/CustomDestinations, with ShellBags, and ShellBagsView is not a Jump List parser. Option D names real ShellBag internals (MRUListEx and NodeSlot), but manually inspecting only those values in Windows Explorer is incomplete and not a forensic parsing approach. None matches BagMRU/Bags plus SBag as cleanly as C.
Community Comment Notes
aqeel1506 points to the CHFI v10 textbook’s emphasis on ShellBag data and SBag’s parsing role, which supports C. Elb explains that ShellBags record folder viewing preferences and can persist after a directory is removed, and also notes they can show folders opened from a mounted external drive. 4bd3116 likewise argues that parsing BagMRU and Bags with SBag is the most effective route to deleted-directory and mounted-drive evidence.
Exam Strategy
When a question names deleted directories, removable drives, and Explorer actions together, map it to ShellBag registry keys rather than LNK or Jump List artifacts. Look for the tool that explicitly parses BagMRU and Bags, and reject options that pair a well-known artifact with the wrong parser.
Frequently Asked Questions
Why is analyzing LNK files with ShellBags Explorer not the best choice?
Do ShellBags prove a suspect deleted a specific folder?
Community Votes
67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
aqeel1506 👍 2C: Parsing the BagMRU and Bags registry keys using SBag: This option aligns well with the CHFI v10 textbook’s emphasis on examining ShellBag data, which includes the BagMRU and Bags registry keys. SBag is designed to parse ShellBag information, making it an effective tool for analyzing accessed and deleted directories.
-
Elb 👍 2 Answered AShellBags are a set of registry keys which record the viewing preferences of folders of the user, such as their size, location and position, when using Windows Explorer. The information in these ShellBags plays a crucial role in the forensic investigation as it provides evidence related to folders accessed by a user.
-
Elb 👍 1LNK is a file extension for shortcut files used by Windows OS to point to any executable files These files are created when a user/suspect accesses any local/remote file and can provide forensic investigator with valuable information on user activities on the system These artifacts also help forensic investigators find the LNK files associated with the original files that no longer exists on the target machine
-
4bd3116 👍 1 Answered CC. Parsing the BagMRU and Bags registry keys using SBag This approach is the most effective for obtaining detailed information about recent actions, deleted directories, and mounted drives. It leverages the ShellBags data stored in the Windows registry, which includes valuable historical information about user interactions with the filesystem.
-
Elb 👍 1The ShellBags contain information pertaining to the directories (accessed by the user) even after the directory is removed, which can be used to enumerate previously mounted drives, deleted files and User/Intruder action.
Show 1 more comment
-
Elb 👍 1Analyzing ShellBags provides forensic investigators with data such as: ▪ Folders opened by user from a mounted external hard drive.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.