Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 6 additions & 23 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,33 +1,16 @@
# SeeShells: Windows Shellbag Timeline Display & Parser
[![GitHub release (latest by date)](https://img.shields.io/github/v/release/ShellBags/v2?include_prereleases)](https://github.com/ShellBags/v2/releases/tag/v2.0-beta.4)
[![GitHub All Releases](https://img.shields.io/github/downloads/ShellBags/v2/total)](https://github.com/ShellBags/v2/releases)
[![SeeShells License](https://img.shields.io/github/license/RickLeinecker/SeeShells)](https://github.com/RickLeinecker/SeeShells/blob/master/LICENSE)
<img align="left" src="websiteV2/src/assets/croppedV2Logo.png" width=115/>

[![SeeShells Logo](website/src/assets/logo.png)](https://rickleinecker.github.io/SeeShells/)
### [Visit v1 Website](https://rickleinecker.github.io/SeeShells/)
### [Visit v2 Website](https://rickleinecker.github.io/SeeShellsv2/#/)

SeeShells is a configurable Windows desktop application which focuses on extracting specific Registry data known as ShellBags. SeeShells displays this information in a interactive timeline that highlights user events as they were recorded.
[![GitHub release (latest by date)](https://img.shields.io/github/v/release/ShellBags/v2?include_prereleases)](https://github.com/RickLeinecker/SeeShellsv2/releases/tag/v2.0-beta.4)
[![GitHub All Releases](https://img.shields.io/github/downloads/ShellBags/v2/total)](https://github.com/RickLeinecker/SeeShellsv2/releases)
[![SeeShells License](https://img.shields.io/github/license/RickLeinecker/SeeShells)](https://github.com/RickLeinecker/SeeShellsv2/blob/master/LICENSE)

The goal of SeeShell is to assist digital forensics investigators in their course of actions and provide more information that can be used as evidence in a court of law.
SeeShells is a digital forensics tool that parses and analyzes shellbag data from the Windows Registry. Our application detects patterns shellbag data to recreate a timeline of past user activity.

In addition to the timeline, SeeShells provides exporting:
- CSV of all ShelBag information parsed.
- HTML representation of the timeline
- PDF for formal forensics reporting

SeeShells operates on both running machines (live) and registry hive files (offline).

## Requirements
- Windows Vista SP2 or newer
- [NET Framework 4.6](https://www.microsoft.com/en-us/download/details.aspx?id=53344) or newer


## Configuration
JSON configuration files are used within the SeeShells application to provide information about Windows versions and their registry keys.
This ensures that if any new discoveries are found in the future regarding ShellBag information, they can easily be updated in the configuration file, and the program can adjust accordingly.

See the [Help Section](https://rickleinecker.github.io/SeeShells/help) for modifying SeeShells configurations.
### [Check out our website to learn more](https://rickleinecker.github.io/SeeShellsv2/#/)

## Contributors
### v1 Developers
Expand Down