ShellBags Forensics Cheat Sheet

What it is

ShellBags are the registry entries Windows Explorer uses to remember how each folder was displayed (view mode, icon size, sort order, window position). To do that, Explorer records every folder the user opens, as a tree of shell items. The side effect is a per-user history of folder navigation that covers local disks, removable drives, network shares, ZIP archives, mobile devices and even Control Panel pages, and that survives after the folder is deleted or the device is removed.

Location

Windows version	Hive	Keys
XP	`NTUSER.DAT`	`Software\Microsoft\Windows\ShellNoRoam\BagMRU` + `\Bags`, and `Software\Microsoft\Windows\Shell\BagMRU` + `\Bags` (network and removable locations)
Vista / 7 / 8 / 10 / 11	`UsrClass.dat`	`Local Settings\Software\Microsoft\Windows\Shell\BagMRU` + `\Bags` (most entries)
Vista / 7 / 8 / 10 / 11	`NTUSER.DAT`	`Software\Microsoft\Windows\Shell\BagMRU` + `\Bags` (fewer entries, often Desktop-related)

UsrClass.dat lives in C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat.

What it proves

The user opened or browsed a folder in Explorer or in a file open/save dialog, with its full reconstructed path.
Folders that no longer exist: deleted directories, unplugged USB drives, disconnected shares and extracted-then-deleted archives remain in the tree.
Device context: entries for removable drives carry the drive letter and folder names; MTP devices (phones, cameras) appear by device name.
It does not prove that a particular file inside the folder was opened (see LNK files and Jump Lists).

Key fields

Element	Meaning
`BagMRU` subkeys `0`, `1`, `2`…	Tree that mirrors the folder hierarchy; each level is one path component
Numbered values	Binary shell item describing that component (folder name, type, sometimes MFT reference and timestamps)
`MRUListEx`	Order in which child folders were most recently accessed (first = most recent)
`NodeSlot`	Index of the matching `Bags\<n>` key that holds view settings
`Bags\<n>\Shell`	View settings; its presence confirms the folder window was actually displayed

Timestamps

Timestamp	Set when	Format	Pitfalls
Created / modified / accessed times inside a file-entry shell item	Copied from the folder's own timestamps when the shell item was built	DOS date/time, 2-second resolution	Describe the folder, as it was at that moment, not the user's access
`BagMRU` key LastWrite	A child was added or `MRUListEx` changed	FILETIME, UTC	Applies to the most recently accessed child (first in `MRUListEx`); parsers report it as "last interacted" for that child only
First value written	New folder added	—	Tools such as SBECmd infer "first interacted" when a key holds a single child; do not extend it to siblings

Retention and clearing

ShellBags accumulate for the life of the profile; Windows limits the number of Bags entries, so very old view settings can be recycled while BagMRU entries remain.
Deleting the keys requires editing the user's hive (privacy cleaners do this); traces often remain in hive slack and in volume shadow copies.
Recent changes may only exist in UsrClass.dat.LOG1/.LOG2; always parse with transaction logs.

Collection

KAPE target: RegistryHivesUser (NTUSER.DAT, UsrClass.dat and their logs for every profile)
Velociraptor (Windows.Triage.Targets): RegistryHivesUser; Windows.Forensics.Shellbags parses them live.
Built-in: the hives of logged-on users are locked; for the current user:

reg save "HKCU\Software\Classes" E:\case\UsrClass.hiv
reg save HKCU E:\case\NTUSER.hiv

reg save of HKCU\Software\Classes exports the live merged view; prefer raw copies of the hive files with their logs.

Parsing tools

ShellBags Explorer and SBECmd (Eric Zimmerman): SBECmd.exe -d E:\case\Users --csv E:\out processes every hive in a folder tree, including deleted keys recovered from hive slack.
RegRipper: shellbags plugin.
Velociraptor: Windows.Forensics.Shellbags.

Investigation tips

Filter on removable-drive letters, \\server\share paths and archive names (.zip folders) to show what a user explored on USB sticks and shares; correlate with USB device history.
A folder named after sensitive projects on an external drive, plus LNK or Jump List entries for files inside it, makes a strong data-access narrative.
Look for tool folders (mimikatz, PSTools, rclone) that were deleted from disk but remain in ShellBags.
Keep the timestamp semantics straight: shell-item times date the folder, key LastWrite dates the user's latest interaction with one child.
Compare with TypedPaths and OpenSave/LastVisited MRU to see how the user reached a location.

ShellBags

Tools