Where Are Windows ShellBags Stored?
Windows ShellBags in registry Bags keys tracking browsed folder views and USB history.
Last updated
Windows remembers folder view settings per directory in ShellBags, recording every folder browsed including deleted ones and long-gone USB drives. Path, timestamps and view mode persist in registry Bags keys.
Investigators reconstruct USB usage and deleted folder access from these remnants. The data hides across user hives plus UsrClass, so collect both.
Where Windows stores this, by platform
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags
Folder view memory lives here with paths in BagMRU siblings. Per-user file-association views sit in HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU. Export hives offline for parsing; ShellBags Explorer style tools decode the binary.
Frequently asked questions
What do ShellBags reveal?
Folders a user browsed, including deleted directories and removed USB volumes, with first-visit timestamps. It is a browsing history for the filesystem.
How do I clear ShellBags?
Delete the Bags keys with Explorer closed. Windows rebuilds them as folders open, so the trail restarts immediately.
Notice an outdated path? Let us know.