Dangling B2 bucket reference — ShellBags Explorer download link

[Math7-prog]

reference — ShellBags Explorer download link

Summary
The direct download link for ShellBags Explorer via Backblaze B2
appears to point to a bucket that no longer exists:

https://f001.backblazeb2.com/file/EricZimmermanTools/ShellBagsExplorer.zip

Requesting this URL returns:

​json { "code": "not_found", "message": "Bucket with such name does not exist.", "status": 404 } ​

Why this matters
When testing (without completing registration or entering real
payment details), the bucket name EricZimmermanTools did not
trigger a name-conflict error during bucket creation on B2 — the
flow only stopped at the billing step. This suggests the name may
currently be unclaimed and could potentially be re-registered by
an unrelated third party.

If that happens, any legacy link, script, or documentation still
pointing to this bucket could end up serving content from an
unauthorized source instead of the original tool — a supply-chain
risk given this toolset's use in forensic investigations.

What I've done
I've already submitted a responsible disclosure report to
Backblaze's security team (security@backblaze.com) with full
technical details and screenshots. Happy to share that report here
too if useful.

Suggested action
Worth confirming whether current official download links still
rely on this bucket, and updating any references if they're
outdated (e.g. pointing users to the GitHub Releases page instead).

Thanks for all the great tools — just wanted to flag this in case
it's relevant.

[Math7-prog]

Update — evidence of ongoing real-world exposure

Following up with additional evidence that this isn't just a
theoretical concern — the old bucket URL is still actively
referenced today in multiple independent, external sources:

• A public CTF/forensics training platform (CyberDefenders) links
  directly to this URL in an active training lab.
• A separate forensic automation project confirmed this exact URL
  had gone dead and had to patch it manually:
  Eric Zimmerman's FTP site has changed. backbalze URL is no longetr valid in setup.sh IncideDigital/rvt2#1
• A community-maintained Chocolatey package (approved as recently
  as March 2025) still follows this legacy URL pattern.
• Several technical blog posts (2021–2024) still list this as the
  recommended download link.

This suggests there may still be a meaningful number of scripts,
docs, and tools out there pointing to a bucket name that could
potentially be re-claimed by an unrelated party. Might be worth
a pinned note or redirect if the canonical source has fully moved
to download.ericzimmermanstools.com.

Happy to help track down more references if useful.

[EricZimmerman]

Yea that has changed a lot over the years. I don't know why people referenced the underlying link vs the page but alas here we are.

It has been relatively recent change to use cloud flares can as people were spamming downloads on b2 and ramping up fees.

The get Zimmerman tools script and my main tools page are all current and now use links I can adjust via DNS

What was the original link to sbe that started this? Where is it?

[Math7-prog]

Good question — I originally found it via a general web search.

Digging into it more, I found it's still directly referenced in
several independent, currently-live external sources:

• A CyberDefenders CTF training write-up (still listing it as an
  active tool link): https://hackmd.io/@missbc/Sy9Nlti-0
• A blog post by the Cyber Defence Lab of the Royal Military
  Academy (Belgium), still linking to the Get-ZimmermanTools.zip
  on the same bucket:
  https://cylab.be/blog/290/install-eric-zimmermans-forensics-toolkit
• A forensics tutorial article from 2021 that embeds the direct
  link twice: https://daydaynews.cc/en/news/1323525.html

So it's not just old indexed pages — these are live pages still
actively pointing people to the dead bucket today.

[EricZimmerman]

Ah. I can fix those tho heh

[Math7-prog]

That's great to hear — thanks for taking the time to look into it,
and appreciate all the work you put into these tools!