ShellBags are Windows registry artefacts that record user interaction with folders, including viewed paths and interface preferences. Investigators use them to show which directories a user browsed, even if the folders were later deleted. They are useful for proving access or interest in locations, but they should be interpreted with other file system and log evidence.
How ShellBags record user folder activity
ShellBags are a Windows artefact tied to folder interaction, not file content. They are written when Explorer or shell components enumerate a directory and can preserve paths, view state, and layout preferences. That makes them valuable because they can show that a user opened or browsed a folder even when the directory no longer exists on disk.
Forensic value comes from the way they capture intent and interaction rather than just storage state. A ShellBag entry can help answer “did this user look here?” or “what path was present in the UI?”, which is why examiners often pair them with other Windows artefacts when reconstructing activity timelines.
Why ShellBags matter in an investigation
ShellBags are especially useful when the filesystem alone is incomplete. Deleted folders, removable media, and renamed paths can leave gaps in a timeline, but ShellBags may still preserve evidence that the path was viewed. That makes them a strong corroborating artefact for proving access, interest, or navigation to a location.
They also help narrow questions about user behavior. If a suspect path appears in ShellBags, investigators can test whether the directory was merely visible in a browser pane, actively opened, or revisited over time. The value is strongest when the artefact is matched with creation times, recent file traces, event logs, and other shell artefacts rather than treated as standalone proof.
For a broader forensic context, the Digital Forensics (DFIR) Guide is the right place to place ShellBags within evidence handling, Windows artefact review, and timeline reconstruction.
What ShellBags can and cannot prove
ShellBags can show interaction with a folder path, but they do not automatically prove file access, file modification, or malicious intent. A path may appear because a user clicked through Explorer, a program enumerated directories on their behalf, or a mounted device exposed a location through the shell. The artefact is informative, but interpretation depends on context.
That is why investigators should avoid overreading a single registry entry. The strongest conclusions come from consistency across multiple artefacts, such as matching path evidence, user profile data, timestamps, and corroborating log sources. When those sources align, ShellBags become a useful visibility layer into past user navigation.
Risk and Threat Considerations
ShellBags create a residual record of browsing activity, so the main risk is evidentiary misinterpretation rather than data loss. They can also expose where a user searched, staged, or explored on a system, which may matter in insider-threat, misuse, or post-compromise investigations.
Failure mechanism: The artefact is often treated as definitive proof of file access when it actually records shell-level folder interaction, and it can outlive the folder itself. If analysts do not cross-check it with other artefacts, they can overstate what was actually observed or miss the difference between browsing and opening content.
Impact: Misreading ShellBags can lead to weak timelines, incorrect attribution of activity, or missed investigative leads. On the threat side, an attacker or insider who knows that folder navigation leaves traces may try to avoid obvious paths, clean related artefacts, or rely on alternate tools, but ShellBags still often remain a useful source of historical visibility.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | ShellBags help detect past user activity from Windows artefacts. |
| Recommendation — Correlate ShellBag artefacts with endpoint telemetry and logs to validate user activity timelines. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | ShellBags need corroboration from audit sources to support defensible conclusions. |
| AU-11 — Audit Record Retention | Historical shell artefacts remain useful only if retained long enough for investigations. | |
| Recommendation — Review and correlate audit evidence before treating ShellBags as proof of access or use. Preserve relevant endpoint and registry evidence long enough to support retrospective analysis. | ||
Practitioner Guidance
What to verify: Treat ShellBags as path-visibility evidence and verify the surrounding context before drawing conclusions. Confirm whether the path also appears in recent file artefacts, user shell history, volume metadata, jump lists, or logs that can show whether the folder was merely viewed or more actively used.
What good looks like: A defensible finding ties ShellBags to a coherent timeline, a known user profile, and one or more independent artefacts that support the same directory activity. If those confirmations are missing, the safest conclusion is that the user likely browsed the location, not that they accessed specific contents.
Practitioner takeaway: ShellBags are most valuable when they are used to corroborate a broader story, not when they are asked to carry the whole case on their own.