Which Windows Artifact Best Reveals Deleted Folders and Mounted Drives?
A forensic investigator is analyzing a Windows system for possible malicious activity. The investigator is specifically interested in the recent actions of a suspect on the system, including any deleted directories or files, mounted drives, and actions taken. Which of the following approaches and tools would be the most effective for obtaining this information?
Community Votes
67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can separate ShellBag registry evidence from LNK and Jump List artifacts; the trap is picking a familiar tool name paired with the wrong artifact.
Windows ShellBags, stored in the BagMRU and Bags registry keys, record Explorer folder views and can preserve evidence of deleted directories, mounted drives, and suspect actions. This page establishes that parsing those keys with SBag is the correct answer (C), not analyzing LNK files with ShellBags Explorer.
Most learners choose A because ShellBags Explorer sounds authoritative, but it is designed for ShellBags, not LNK files, and the question’s deleted-directory and mounted-drive emphasis points to BagMRU/Bags parsing with SBag.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
ShellBags are user-specific registry structures stored under BagMRU and Bags; they record how folders were viewed in Windows Explorer, including folder names, paths, and references to removable or network locations. Because those records can outlive the folder itself, they are useful for reconstructing deleted directories and previously mounted drives. SBag is purpose-built to parse BagMRU and Bags, so option C directly matches the artifact to the forensic tool. This is the strongest fit for the question’s request for recent suspect actions involving deleted directories/files and mounted drives.Why the Other Options Are Wrong
Option A is internally mismatched: LNK files are shortcut artifacts, while ShellBags Explorer is a ShellBag parser, not an LNK analyzer; LNKs may show file targets but do not provide the same folder-view and deleted-directory history. Option B confuses Jump Lists, which live in AutomaticDestinations/CustomDestinations, with ShellBags, and ShellBagsView is not a Jump List parser. Option D names real ShellBag internals (MRUListEx and NodeSlot), but manually inspecting only those values in Windows Explorer is incomplete and not a forensic parsing approach. None matches BagMRU/Bags plus SBag as cleanly as C.Community Comment Notes
aqeel1506 points to the CHFI v10 textbook’s emphasis on ShellBag data and SBag’s parsing role, which supports C. Elb explains that ShellBags record folder viewing preferences and can persist after a directory is removed, and also notes they can show folders opened from a mounted external drive. 4bd3116 likewise argues that parsing BagMRU and Bags with SBag is the most effective route to deleted-directory and mounted-drive evidence.Exam Strategy
When a question names deleted directories, removable drives, and Explorer actions together, map it to ShellBag registry keys rather than LNK or Jump List artifacts. Look for the tool that explicitly parses BagMRU and Bags, and reject options that pair a well-known artifact with the wrong parser.
Frequently Asked Questions
Why is analyzing LNK files with ShellBags Explorer not the best choice?
ShellBags Explorer parses ShellBag registry data, not LNK shortcut files; LNKs may show target paths but do not directly reconstruct deleted folder views and mounted-drive history like BagMRU/Bags do.
Do ShellBags prove a suspect deleted a specific folder?
No. ShellBags show that a folder was viewed or interacted with in Explorer and can persist after deletion, but they are circumstantial evidence and should be correlated with other artifacts.