ShellBags are Windows registry artefacts that record how a user viewed folders in File Explorer, including folder paths and display preferences. They help investigators prove user access to directories, even if files were deleted. Analysts use them carefully, because they reflect interaction history rather than the file contents themselves.
What ShellBags Tell Investigators
ShellBags are Windows registry artefacts, so they sit at the boundary between user activity and system state. They are valuable because they preserve evidence of folder viewing behaviour, not because they prove file content or direct file execution.
Forensic analysts use ShellBags to reconstruct which directories a user navigated to, how those folders were displayed, and whether a path was likely opened in File Explorer. That makes them especially useful when a directory is gone, filenames have been removed, or other artefacts are incomplete.
How ShellBags Are Interpreted
ShellBags should be read as interaction history, not as a full record of every file or action inside a folder. They can support a timeline, corroborate access to a location, and help narrow the window in which a user was active on a system.
Their evidentiary value comes from context. A ShellBag entry may show that a folder path existed in a user profile and was likely rendered by Explorer, but it does not by itself establish that a specific document was opened, copied, or altered.
Where ShellBags Fit in Windows Forensics
ShellBags are one of several Windows artefacts that help build a user activity picture alongside registry data, jump lists, recent files, Prefetch, and filesystem metadata. Digital Forensics (DFIR) Guide is a useful companion for understanding how registry artefacts, timelines, and evidence handling fit together.
They are most useful during triage and timeline reconstruction, when investigators need to determine whether a directory was viewed before deletion, cleanup, or system compromise. Their strength is correlation, because they often gain meaning when combined with other artefacts rather than viewed in isolation.
Collection and Analysis Cautions
ShellBags are easy to overread. They can reflect Explorer behaviour, profile activity, and historical folder interactions, but they do not prove intent, exfiltration, or file content access on their own.
Analysts should treat them as one evidentiary input among several and verify the registry source, user context, and timeline before drawing conclusions about access. Careful handling matters because the artefact is most persuasive when its interpretation is narrow and well-supported.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | ShellBags support forensic review of user activity evidence. |
| SI-4 — System Monitoring | ShellBags are one of the Windows artefacts used in monitoring and investigation. | |
| Recommendation — Review ShellBag-derived artefacts with audit data to reconstruct access timelines. Correlate ShellBags with endpoint monitoring to detect suspicious folder access patterns. | ||
| MITRE ATT&CK | T1083 — File and Directory Discovery | ShellBags can evidence directory discovery and folder enumeration behavior. |
| Recommendation — Map observed folder-view activity to directory discovery and hunt for reconnaissance. | ||
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org