ShellBags
Definition
Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on removable drives no longer attached.
- Registry hives
- UsrClass.dat and NTUSER.DAT, under Shell\BagMRU and \Bags
- Records
- Folder paths opened in Explorer, including window position and view settings
- Survives deletion
- Yes, entries persist for folders and removable drives no longer present
- Tool support
- ShellBags Explorer (Eric Zimmerman), RegRipper plugins
Common questions
Why are ShellBags useful when the folder itself has been deleted?+
The registry keeps the folder record even after the folder, drive, or file is gone, because the entry is written when Explorer displays the folder, not tied to the target's continued existence. This lets an examiner show a USB drive or network share was browsed even though nothing from it remains on disk.
Do ShellBags prove a file was opened, or just that a folder was viewed?+
Only that the folder was displayed in Explorer, not that any file inside it was opened, copied, or read. Pairing ShellBags with LNK files, jump lists, or recent-file MRU lists is needed to show individual file interaction.
Related terms
- Alternate Data Stream (ADS)
- An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname....
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Hiberfil.sys
- The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often...
- LNK File
- A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the...
- Volume Shadow Copy (VSS)
- Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE,...