February 20, 2015: shellbags-0.5.5-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - Shellbags Microsoft Windows uses a set of
registry keys known as "shellbags" to maintain the size, view, icon, and position of a folder when using Explorer. Shellbags persist information for
directories even after the directory is removed, which means that they can be used to enumerate past mounted volumes, deleted files, and user actions.
See Using shellbag information to reconstruct user activities for an overview of the
investigative value of shellbags.
January 12, 2012: shellbags-0.5.1-2.{fc14,fc15,fc16}.noarch.rpm - Shellbags Microsoft Windows uses a set of
registry keys known as "shellbags" to maintain the size, view, icon, and position of a folder when using Explorer. Shellbags persist information for
directories even after the directory is removed, which means that they can be used to enumerate past mounted volumes, deleted files, and user actions.
See Using shellbag information to reconstruct user activities for an overview of the
investigative value of shellbags. Shellbags is installed in the Fedora 14, 15, and 16 versions of the repository.