Nana Sei Anyemedu

The SILENT WITNESS ON YOUR COMPUTER WAITING FOR YOU TO GET INTO TROUBLE. Most people believe that deleting a folder, clearing recent files, or wiping their history is enough to hide their tracks on a computer. What they don’t realize is that Windows quietly keeps a hidden record of the folders they open, even after those folders are deleted or the drive is removed. These records are called Shellbags, and they are one of the most powerful and incriminating artifacts available to forensic investigators. Shellbags appear inside two registry hives NTUSER.DAT and USRCLASS.DAT and they store detailed information about a user’s folder-browsing activity. This includes local folders, USB drives, external hard drives, network shares, and even directories that no longer exist. Each time a user opens a folder in Windows Explorer, the system automatically creates or updates a Shellbag entry. These entries contain timestamps, folder paths, the hierarchy of subfolders, the order in which a folder was accessed, and even the specific view settings used by the user. Because of this, Shellbags reconstruct a user’s exact navigation trail long after the person believes the evidence is gone. What makes Shellbags truly dangerous is the fact that they survive actions that users typically rely on to cover their tracks. Deleting a folder does not delete the Shellbag. Formatting a drive does not delete it. Even privacy tools and cleaners like CCleaner or BleachBit cannot reliably erase Shellbag data, because the information is deeply embedded within registry hives that standard cleaning utilities do not touch. The only way to remove Shellbags is through advanced forensic wiping, and attempting such wiping is, in itself, a sign of suspicious behavior. Forensic examiners rely heavily on Shellbags because they expose the truth even when a suspect tries to lie. If a person denies ever accessing a directory, the Shellbags can show when that folder was opened, how many times it was accessed, and whether it was located on an internal drive, an external USB, or a deleted partition. This makes Shellbags extremely valuable in investigations involving insider threats, data theft, fraud, child exploitation, unauthorized data access, and corporate disputes. In many cases, Shellbags become the deciding factor that disproves a suspect’s story. In the screenshot, the highlighted red section shows three important keys inside the registry. When all of this information is combined, Shellbags become a silent witness that never forgets. They reconstruct a hidden story of user activity that the person cannot deny, overwrite, or talk their way out of. This is why Shellbags remain one of the most feared artifacts for anyone attempting to conceal their actions on a Windows computer. You can delete the folder… but Shellbags still show it existed Even if you format a drive or delete the directory, Windows has already logged: 1. The folder name 2. Its full path 3. When it was opened 4. How many times it was opened 5. The view settings (icon mode, window size) 6. The order in which folders were browsed This means forensic investigators can prove someone accessed: “Secret” directories Hidden folder structures USB drives or removable media Folder paths used for storage of illicit or suspicious Folder paths used for storage of illicit or suspicious data even if the folders are long gone.

@FabrizioRomano @Heavenisthego This is not the final squad😂😂

@GhanaBlackstars Baba RAHMAN😂😂

🚨 Head Coach Carlos Queiroz has named a 28-man squad for the #BlackStars training camp in Cardiff, ahead of the international friendly against Wales. 🇬🇭🏴󠁧󠁢󠁷󠁬󠁳󠁿 ✍🏾 more on: ghanafa.org/black-stars-co…

@IamTheCyberChef Kwasia na me and you no Dey here😂😂

@RedHatPentester You too let's be serious. Bug what? Tsw😂

Masa Masa😂😂. Many of us anticipated this trend because these hacking groups seemed heavily focused on government infrastructure in Kenya and Nigeria, almost like they were turning vulnerable systems into CTF challenges to prove a point from the start of year. One of the best ways to reduce this is for the Ministry of Communication and CSA to start organizing serious bug bounty and responsible disclosure programs but… yeah let’s invest in AKU🌚🌚

@noskcid64 Forget them

@RedHatPentester I remember u made a thread regarding USSD n momó vulnerabilities they thought we were discussing was bogus.

It was only a matter of time. What we have witnessed in Nigeria and Kenya since the beginning of the year now appears to be unfolding in Ghana as well. Many of us anticipated this trend because the activities of these hacking groups seemed heavily focused on government infrastructure, almost as though they were using vulnerable systems as capture-the-flag environments to demonstrate weaknesses and make a statement. This is precisely why mature cybersecurity ecosystems in countries such as the United States, China, and Russia encourage responsible disclosure programs and structured vulnerability reporting frameworks. These initiatives help security researchers report flaws safely before malicious actors exploit them. Even Germany’s military has expanded joint cybersecurity exercises with other EU nations to strengthen collective cyber defense capabilities and improve resilience against attacks targeting critical infrastructure. Cybersecurity can no longer be treated as an afterthought. Protecting national digital infrastructure requires proactive investment, collaboration with security researchers, and continuous security assessments. But yeah let’s invest in AKU🌚

@RedHatPentester @CyberRacheal This issue eh, it will be for another day😂 for now make I just observe on the TL

Even with AKU in place, I am sure potential vulnerabilities could still exist. A modern AI penetration test would likely uncover issues ranging from direct prompt injection to more complex, multi-step exploitation chains. But I don’t even think this has crossed their minds😂😂

@RedHatPentester Just do a verbose curl to the domain and see the information disclosure 😁

@ife0x01 Sure

@RedHatPentester sure boss, i will Please do more BAC/IDOR ctfs, more advanced ones

Easy... @RedHatPentester

Are you aware ECG was attacked with ransomware few years ago? The ransomware incident involving ECG a few years ago served as a critical wake-up call, highlighting the need to strengthen the national cybersecurity ecosystem. However, the organization responsible for handling the response did not release a public report detailing the incident. And also after rectifying the issue everybody go bed😂 While confidentiality agreements and operational sensitivities may limit disclosure, a basic level of transparency could have helped improve public awareness and trust. We have long way to go🤦🏾‍♂️🤦🏾‍♂️

@nyarkosam1 @koboateng @itwashalliday One million coders

@RedHatPentester @koboateng @itwashalliday We are joking!!

The Ministry of Interior website has been hacked. If government agencies cannot secure their own systems, how can citizens trust that their data and digital services are safe? Instead of focusing on building better systems, their focus is on license fees and threatening punishment for non-compliance. Ghana needs reliable systems that actually work. We deserve better. Site: mint.gov.gh

@koboateng , I think some few government websites still host important public information, which makes the recurring security issues even more concerning. From where I sit, many of these government platforms appear to be static and poorly maintained, which often signals low prioritization of ongoing security management. This creates an environment where known vulnerabilities persist and are repeatedly exploited. The funny thing is solutions dey, but misplaced priorities 😂😂.

@ife0x01 You are the boss👏🏽👏🏽👏🏽

@RedHatPentester Yeah or a small cyber team dedicated to official government sites

@RedHatPentester @koboateng @itwashalliday Bug what? You too why😂😂

Most of these government websites look like they were built during a 48-hour “ONE MILLION CODERS” coding bootcamp final project presentation. Some of them are so vulnerable you’d think “security” was an optional checkbox they skipped to meet submission deadline. At this point, attackers are not even hacking; they’re just clicking around and discovering features the developers forgot to hide.

@CSAGhana @samgeorgegh @NITAGhana

Last time it was Kenya, then it moved to Nigeria where we saw hackers practically turning most of their infrastructure into a CTF environment, and now it’s Ghana. This is what happens when priorities are misplaced. One of the best ways to reduce incidents like these is for governments to establish serious bug bounty programs that encourage responsible disclosure before vulnerabilities are exploited publicly. At this point, I wouldn’t even be surprised if some of those in authority don’t fully understand what that means. And honestly, if attackers can breach an entire Interior Ministry : an institution responsible for internal security and national safety , then everyone should be deeply concerned.