Hey #DFIR, have you seen any writeups on Win7 shellbags? The format is certainly augmented. @robtlee