Bags are Windows Registry entries that store per-folder view settings for Explorer, such as column order, icon size and window layout. They are part of the shell’s user interface state, and can help forensic analysis show which folders were opened and how they were viewed.
What Bags Are in Windows Forensics
Bags are registry-backed Explorer view-state records, not content data. They show how a user opened a folder, including layout preferences such as column order and icon sizing, which makes them useful for reconstructing recent activity and interface behaviour.
Where Bags Live and What They Preserve
Bags are part of Windows shell state stored in the Registry, typically under user-specific hive locations. Because they are per-folder and per-user, they can preserve a surprisingly detailed trail of how a person interacted with the file system, even when the files themselves are no longer present.
This makes Bags relevant to investigations that need to separate file existence from user interaction. A folder view can indicate that a path was opened, resized, or arranged in a particular way, which may support timeline building when combined with other artefacts such as MITRE ATT&CK Enterprise Matrix for broader endpoint activity mapping and NIST SP 800-53 Rev 5 Security and Privacy Controls for logging and configuration governance.
Why Bags Matter for Investigations
Bags can help answer practical forensic questions such as which folders were reviewed, whether a directory was navigated repeatedly, and whether a user likely customised a view before or after a specific event. That makes them a contextual artefact, not a standalone proof of file access or intent.
Forensic value depends on correlation. Bags are strongest when they are interpreted alongside shell items, recent file artefacts, registry timestamps, and other user-interaction evidence. They often help narrow a suspect window rather than prove a full sequence on their own.
Because Bags are shell state, their meaning is constrained by the operating system’s caching and cleanup behaviour. A changed or missing record does not automatically mean the folder was never opened; it may simply reflect reset state, profile activity, or normal Explorer behaviour.
How to Read and Use Bags Safely
Analysts should treat Bags as contextual evidence and avoid overstating them as direct proof of document execution or data exfiltration. Their value is in reconstructing interaction patterns, especially when a case needs to show whether a directory was merely present or actively viewed.
The most defensible interpretation usually comes from comparing multiple users, multiple folders, and multiple artefact types. A single Bags entry can support a lead, but a pattern of consistent folder-view changes is much more meaningful than one isolated record.
When documenting findings, keep the distinction clear between folder-view state and file-content access. That discipline helps avoid common forensic errors and makes the evidence easier to defend in review.
Risk and Threat Considerations
Bags are low-level but sensitive because they can reveal user navigation habits, recent investigative focus, and the structure of folders a user considered important. In incident response, that context can be useful to defenders and equally useful to an insider or intruder who wants to understand what was opened or searched for.
Failure mechanism: The artefact stores behavioural traces in a place that may persist longer than expected, so an attacker with access to the profile or hive can infer folder interest, investigative activity, or prior browsing patterns.
Impact: Exposure of this data can assist reconnaissance, support post-compromise understanding of analyst or user actions, and create privacy concerns where folder names or view patterns are operationally sensitive.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1213 — Data from Information Repositories | Bags are repository-style artefacts used to recover user activity context. |
| Recommendation — Correlate shell-state artefacts with other repository evidence to reconstruct user activity. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Bags are forensic context artefacts that support event reconstruction and review. |
| CM-6 — Configuration Settings | Bags record interface configuration state that reflects system and user settings. | |
| IR-4 — Incident Handling | Bags can support incident triage by showing folder interaction context. | |
| Recommendation — Preserve and review endpoint artefacts alongside event logs to support investigations. Define and manage shell configuration baselines so forensic artefacts remain interpretable. Use host artefacts during incident handling to validate timelines and scope. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org