drop shellbag csv and mft csv · identify directories accessed per shellbags that no longer exist in mft · surface deleted folder access history · detect shellbag clearing · runs locally
SBECmd / ShellBags Explorer shellbag export + MFTECmd MFT csv (InUse directories)
drop shellbag csv (sbe) and mft csv — multiple files ok