> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/folder-file-opening-creation/shell-bags.md).

# Shell Bags

Shell Bags are Windows registry artifacts that record user preferences for folder views in Windows Explorer and the Open/Save dialog. They track details like icon size, window position, sort order, and view mode (list, details, tiles, etc.) for every folder a user has browsed. Because these settings persist even after the folders themselves are deleted, Shell Bags provide forensic evidence of folder access, including folders on local drives, network shares, removable devices, and ZIP archives.

### Location

Shell Bags data is split across two per-user registry hives:

**Primary (most Shell Bags data):**

```
File: C:\Users\<username>\AppData\Local\Microsoft\Windows\UsrClass.dat

Keys:
  Local Settings\Software\Microsoft\Windows\Shell\Bags
  Local Settings\Software\Microsoft\Windows\Shell\BagMRU
```

**Secondary (desktop items, network shares, some residual data):**

```
File: C:\Users\<username>\NTUSER.DAT

Keys:
  Software\Microsoft\Windows\Shell\BagMRU
  Software\Microsoft\Windows\Shell\Bags
```

Both hives should be collected during an investigation. The `UsrClass.dat` file is located in a hidden `AppData\Local\Microsoft\Windows` directory within each user's profile.

### What Shell Bags Record

* **Folder paths** accessed via Windows Explorer or the Open/Save dialog, including local, network, and removable media paths.
* **Timestamps:** First interaction and last interaction times with each folder, plus file system timestamps (Created, Modified, Accessed) for the folder itself at the time of access.
* **View preferences:** Icon size, window position, sort column, view mode, column widths.
* **"Exotic" items:** Mobile device connections (MTP), Control Panel access, ZIP archive browsing, FTP folder access, search folder results.
* **Deleted folder evidence:** Shell Bag entries persist after the original folder is deleted or the drive is disconnected. The registry entry remains until the user's profile is removed or the keys are manually cleared.

### How Shell Bags Work

**BagMRU** tracks the hierarchical tree structure of folders the user has browsed. Each node in the tree represents a folder, and child nodes represent subfolders. This forms a navigational breadcrumb trail showing the paths a user took through the file system.

**Bags** stores the actual view settings for each folder. Each entry is linked to a corresponding BagMRU node by a numeric slot number.

Shell Bags are only populated through **Windows Explorer** and the **Open/Save common dialog**. Folder access via the command line (`cd`, `dir`), PowerShell, or programmatic file I/O does **not** generate Shell Bag entries. This is both a limitation and a forensic indicator: Shell Bags specifically reflect GUI-based user interaction.

#### Windows 11 Behavior

Shell Bags behavior on Windows 11 is consistent with Windows 10. Folders created via command line (`mkdir`) do not generate Shell Bag entries unless the user subsequently navigates to them in Explorer. The core mechanism is unchanged: Shell Bags only record Explorer/dialog-based folder interaction.

### Analyzing Shell Bags

#### SBECmd (Command Line)

[SBECmd](https://github.com/EricZimmerman/SBECmd) is Eric Zimmerman's command-line tool for parsing Shell Bags data. It can process individual hive files or recursively scan directories for hives.

**Parse from a directory of collected hives:**

```
SBECmd.exe -d C:\Cases\Evidence\Registry --csv C:\Cases\Output --csvf shellbags.csv
```

**Parse from a live system (requires admin):**

```
SBECmd.exe --live --csv C:\Cases\Output --csvf live_shellbags.csv
```

SBECmd automatically locates and parses both `UsrClass.dat` and `NTUSER.DAT` hives when given a directory. Output includes folder paths, timestamps, view settings, and the user account associated with each hive.

#### ShellBags Explorer (GUI)

[ShellBags Explorer](https://ericzimmerman.github.io/#!index.md) is the GUI version of the same parser. It displays the BagMRU tree structure visually, letting you browse the folder hierarchy as the user saw it. The Details tab shows timestamps and metadata for each selected node. This is useful for targeted analysis and understanding the full navigation path a user took.

#### Other Tools

* [**Registry Explorer**](https://github.com/EricZimmerman/RegistryExplorer) **(Eric Zimmerman):** Browse the raw Shell Bags registry keys for manual inspection.
* [**Autopsy**](https://www.autopsy.com/)**:** Parses Shell Bags as part of its Recent Activity ingest module.
* [**Velociraptor**](https://docs.velociraptor.app/)**:** The `Windows.Forensics.Shellbags` artifact natively parses Shell Bags data across endpoints without requiring external tools.
* [**KAPE**](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)**:** Targets for collecting `UsrClass.dat` and `NTUSER.DAT`, with modules for SBECmd parsing.

### What to Look For

* **Folders on removable media:** Shell Bags retain entries for USB drives and external media long after they are disconnected. This can prove a user browsed files on a specific device even if the device is no longer available.
* **Deleted folders:** Entries persist after folder deletion. If a user created a staging folder for exfiltration and then deleted it, the Shell Bag entry may still record the folder name and access times.
* **Network share access:** Entries for UNC paths (`\\server\share\folder`) show which network locations a user browsed and when.
* **Unusual paths:** Folders in temp directories, Recycle Bin paths, or system directories that a normal user wouldn't typically browse.
* **ZIP archive browsing:** Shell Bags record when a user opens and navigates within ZIP files through Explorer, which can indicate reconnaissance of archive contents.
* **Timestamp analysis:** Compare Shell Bag first/last interaction timestamps with other artifacts to build a timeline of user activity.

### Artifact Correlation

* **USB Usage:** Shell Bag entries for removable drives can be correlated with USB connection artifacts (Plug & Play logs, USBSTOR registry keys) to link a specific user to a specific device at a specific time.
* **LNK Files:** LNK (shortcut) files created when a user opens a file from a folder can corroborate Shell Bag evidence of folder access.
* **Jump Lists:** Jump List entries for Explorer may show recent folder access that aligns with Shell Bag data.
* **$MFT / $UsnJrnl:** File system metadata can confirm whether folders recorded in Shell Bags still exist, were renamed, or were deleted.
* **Prefetch:** If a user browsed to a folder containing an executable and then ran it, Shell Bags (folder access) + Prefetch (execution) tells that story.

### Anti-Forensics Considerations

* **Registry key deletion:** An attacker or user can delete the Shell Bags keys from `UsrClass.dat` and `NTUSER.DAT`. However, Windows will regenerate the keys as soon as the user opens Explorer again, so a suspiciously empty Shell Bags structure on a well-used account is itself an indicator.
* **Profile deletion:** Deleting the user profile removes both hive files and their Shell Bags data entirely.
* **Third-party cleaners:** Tools like CCleaner and BleachBit can target Shell Bags data. Check for evidence of these tools via Prefetch or UserAssist.
* **VSS recovery:** Previous versions of `UsrClass.dat` may be available in Volume Shadow Copies, providing historical snapshots of Shell Bags data before cleanup attempts.

### Limitations

* Shell Bags **only** record folders accessed through Windows Explorer or the Open/Save dialog. Command-line, PowerShell, and programmatic access does not generate entries.
* Shell Bags record **folder** access, not individual **file** access. You can prove a user browsed a directory, but not which specific files they opened from it (use LNK files, Jump Lists, or Recent Documents for file-level evidence).
* Timestamp interpretation requires care. The "first interaction" and "last interaction" times reflect when the Shell Bag entry was created and last updated, but these can shift if the user changes view settings for a folder at a later date.

### References

* [Cyber Triage: Shellbags Forensic Analysis 2026](https://www.cybertriage.com/blog/shellbags-forensic-analysis-2026/)
* [SANS: SBECmd](https://www.sans.org/tools/sbecmd)
* [Eric Zimmerman's Tools](https://ericzimmerman.github.io/#!index.md)
* [Revisiting ShellBags in Windows 11 (Ilya Kobzar)](https://www.ilyakobzar.com/p/revisiting-shellbags-in-windows-11)
* [Vincent Lo: Windows ShellBag Forensics in Depth (GIAC)](https://www.giac.org/paper/gcfa/9576/windows-shellbag-forensics-in-depth/128522)