Shell item (ShellItem / PIDL)

A shell item is a small binary record that identifies one element of the Windows Shell namespace: a drive, a folder, a file, a network share, a Control Panel item or a device such as a phone. Explorer does not describe locations with plain paths; it chains shell items into an item ID list, and programs handle that list through a pointer called a PIDL (pointer to an ID list). Walking the list from the Desktop downwards rebuilds the full location.

Shell items appear across many user-activity artifacts: ShellBags in UsrClass.dat, the target ID list of LNK files, the shortcuts embedded in Jump Lists, and several MRU keys such as OpenSaveMRU and LastVisitedMRU.

Their forensic value comes from the metadata captured at the time the item was recorded. A file-entry shell item typically stores the short name and a modification date in the coarse FAT date/time format (two-second resolution). On modern Windows, extension blocks add the long Unicode name, creation and last-access dates and, on NTFS, the MFT file reference — entry number plus sequence number — of the folder or file.

Because this data is a snapshot, shell items can prove knowledge of folders that were later deleted, lived on removable media or sat on a network share. The embedded dates reflect the object when the shell item was created, not necessarily its current state, so compare them with the $MFT before drawing conclusions.