Shellbags
Shellbags are registry artifacts that record every folder a user has browsed through Windows Explorer — including the folder's name, when it was opened, and its visual settings. They persist long after folders are deleted and reveal directory structure on removed media.
A malicious insider copied sensitive IP documents to a USB drive and browsed through several nested directories on that drive before copying files. The USB drive is now gone. The folders they browsed no longer exist anywhere on the system. But Shellbags recorded each folder they navigated into on that USB drive: volume serial number, full folder path hierarchy, and timestamps for when each folder was first and last opened via Explorer. The forensic examiner can reconstruct the folder structure the insider browsed — even naming specific subdirectories — without the physical drive being available.
What Shellbags Record
Windows Explorer stores folder view settings (icon positions, sort order, view type) for every folder a user visits. These settings — called Shellbags — are stored in the registry and include identifying information about the folder itself.
Shellbag Registry Locations
═══════════════════════════════════════════════════════════════════
Primary location (most forensically valuable):
NTUSER.DAT: HKCU\Software\Microsoft\Windows\Shell\BagMRU
NTUSER.DAT: HKCU\Software\Microsoft\Windows\Shell\Bags
Extended location (also valuable — virtual folders):
UsrClass.dat: HKCU\Software\Classes\Local Settings\Software\
Microsoft\Windows\Shell\BagMRU
UsrClass.dat: HKCU\Software\Classes\Local Settings\Software\
Microsoft\Windows\Shell\Bags
Note: UsrClass.dat contains entries for ALL folder types including
network shares, removable drives, and special shell folders.
NTUSER.DAT contains local filesystem folders primarily.
For a complete picture, analyze BOTH hives.
What each entry contains:
├── Folder name
├── Folder GUID or path identifier
├── Date/time the folder was first opened in Explorer
├── Date/time the folder was last modified (via Explorer)
└── Visual settings (icon size, sort column, view type — irrelevant)
Persistence: entries survive:
✓ File deletion
✓ Folder deletion
✓ USB drive removal
✓ Network share disconnect
✗ User profile deletion (entries go with the profile)
✗ Shellbag database cleanup tools (CCleaner etc — check for gaps)
Parsing Shellbags with SBECmd
:: Parse Shellbags with SBECmd (Eric Zimmermann)
:: Parse from collected hive files
SBECmd.exe ^
-d "D:\evidence\C\Users" ^
--csv "D:\analysis\shellbags" ^
--csvf shellbags.csv
:: SBECmd will find NTUSER.DAT and UsrClass.dat in user directories
:: and extract shellbag entries from both
:: Output columns:
:: AbsolutePath — full folder path reconstructed
:: ShellType — type of shell item (File, Volume, Network, etc)
:: CreatedOn — when this folder was first opened in Explorer
:: ModifiedOn — when the folder itself was last modified
:: LastInteracted — when the user last interacted with this entry
:: MRUPosition — order in most-recently-used list
:: Value — raw bag value (for forensic verification)
:: Extension — file extension if it's a file entry
:: Source — which hive this came from (NTUSER or UsrClass)# Find shellbag entries pointing to removable drives or unusual paths
$bags = Import-Csv "D:\analysis\shellbags\shellbags.csv"
# Removable/external drive evidence
$bags | Where-Object {
$_.AbsolutePath -match "^[D-Z]:\\" -and # non-C drive letters
$_.ShellType -match "Volume|Drive"
} | Select-Object AbsolutePath, CreatedOn, LastInteracted, Source |
Sort-Object CreatedOn |
Format-Table -AutoSize
# Network share access evidence
$bags | Where-Object {
$_.AbsolutePath -match "^\\\\[^\\]+" # UNC paths \\server\share
} | Select-Object AbsolutePath, CreatedOn, LastInteracted |
Sort-Object CreatedOn |
Format-Table -AutoSize
# Deep folder browsing — suggests systematic data access
$bags | Where-Object {
($_.AbsolutePath -split "\\").Count -gt 5 # deep nested paths
} | Sort-Object CreatedOn |
Select-Object AbsolutePath, CreatedOn, LastInteracted |
Format-Table -AutoSizeTemporal Analysis of Shellbags
Shellbag timestamps allow you to reconstruct the exact sequence of directory navigation during a suspicious session:
| Timestamp | What it means | Forensic use |
|---|---|---|
| CreatedOn | When the folder was first opened in Explorer | Establishes when the user first navigated to this location — "they found the folder at this time" |
| ModifiedOn | When the folder's contents were last modified via Explorer | Shows last activity involving the folder's contents |
| LastInteracted | Last time the user interacted with this shellbag entry in Explorer | Most recent browsing of this location |
When a USB drive is inserted and browsed, Windows creates shellbag entries for every folder the user opens. These entries persist in the user's profile registry hives indefinitely — even after the USB is removed and regardless of whether the USB's filesystem has any forensic evidence remaining. Combined with USBSTOR registry entries (which show the drive model and serial number) and LNK files (which show specific files accessed), shellbags complete the picture: which directories existed on the drive, which ones the user actually opened, and the timestamps for the browsing session. No other artifact reliably preserves the directory structure of removed external media.
Q & A
Q: An attacker accessed a system via RDP and browsed files using Explorer. Will Shellbags have entries from the RDP session?
Yes — RDP sessions run as the user's Windows session on the target host, and Explorer folder browsing during an RDP session creates Shellbag entries in that user's profile on the target host. This is a powerful forensic indicator: if you're investigating a compromised host and find Shellbag entries for unusual directories (like other users' home directories, sensitive network shares, or archived folders they'd have no business reason to browse), those may reflect attacker reconnaissance via the compromised user's session. The timestamps on those shellbag entries can also correlate precisely with logon/logoff events from the attacker's RDP session (Event 4624/4634), letting you map exactly which directories were browsed during the attacker's session window.