ShellBags Limitations and Anti-Forensics: What to Watch

TL;DR. ShellBags prove navigation in the Windows shell by one account, nothing more. They are blind to console, script and API file access, their times need interpretation, Windows caps how many folders it remembers, and a user (or malware) can delete them with a registry edit or a privacy cleaner. Deletion rarely leaves nothing: look for orphaned Bags keys, MRUListEx lists that reference missing values, deleted keys in unallocated hive cells, older copies in transaction logs and shadow copies, and execution traces of the cleaner itself.

I have seen ShellBags win cases and I have seen them misused in reports. The failure mode is almost always the same: treating the artifact as a complete, tamper-proof log of folder access. It is neither.

What ShellBags cannot tell you

Limitation	Why	What to use instead
File access	Only folders are recorded	LNK files, Jump Lists, RecentDocs
Console / script activity	`cmd`, PowerShell, scripts, and APIs never go through the shell namespace	Execution artifacts (Prefetch, Amcache), PowerShell and Security event logs, USN journal
Exact visit times for most entries	Only the MRU-first child of each folder can be tied to a key write	Corroborate; see ShellBags timestamps explained
Visit counts	No counter exists	Jump Lists (access counts on recent versions)
Device identity	A volume item holds a drive letter only	SYSTEM hive device history, LNK volume serials
Who was at the keyboard	The hive belongs to an account	Logon events, RDP artifacts, context

Things that never create a ShellBag

dir, cd, robocopy, xcopy, Get-ChildItem, Compress-Archive, rclone, most remote administration tools, and malware enumerating files through APIs. Cyber Triage's 2026 overview makes the same point about command-line and browser-based access. An attacker who never opens Explorer leaves no ShellBags at all.

Retention limits

Windows only remembers view settings for a limited number of folders. A BagMRU Size value commonly documented as defaulting to 5,000 on Vista and later (see Winaero's write-up) raises the cap. On heavily used profiles, do not assume the oldest browsing is still there.

Parsing limits

Shell items are undocumented and extensible. Every parser, including the ShellBags Parser, decodes some items only partly (MTP devices, archive content, search results). Unknown does not mean suspicious. Keep the raw hex and cross-check with a second tool before building on an odd entry (tool comparison).

Hive state

A hive copied from a live system is often dirty: the newest writes are in .LOG1/.LOG2. Missing recent ShellBags are more often an acquisition problem than anti-forensics. Replay logs first (Suhanov's registry format specification describes the mechanism).

How ShellBags get removed

Method	What it does	Typical traces
Manual deletion (`regedit`, `reg delete`) of `BagMRU`/`Bags`	Removes keys under `HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell` and/or `HKCU\Software\Microsoft\Windows\Shell`	Tiny tree with a recent root LastWrite; deleted cells in the hive
PrivaZer	Per its documentation, removes the BagMRU trail; keeps `Bags` view settings unless "Remove all" is chosen; can target only "traces of deleted folders"	Orphaned `Bags\<n>` keys; entries for existing folders kept while deleted ones vanish; PrivaZer execution artifacts
CCleaner with community rules (Winapp2)	Deletes the keys listed in the rule file	CCleaner execution artifacts, rule file on disk
Profile reset / new profile	Fresh UsrClass.dat	Profile creation date, old profile folder remnants
Timestamp manipulation	Tools such as SetRegTime can rewrite key LastWrite values through the documented KEY_WRITE_TIME_INFORMATION class	Key times inconsistent with embedded times, child/parent ordering, and other artifacts

Detecting cleaning

1. Structural inconsistencies

Orphaned Bags keys. Every BagMRU entry has a NodeSlot pointing to Bags\<n>. Many Bags\<n> keys with no BagMRU entry pointing at them fit a BagMRU-only wipe. The ShellBags Parser shows each entry's NodeSlot; list the Bags subkeys in Registry Explorer and compare.
MRUListEx referencing missing values. If a parent's MRUListEx lists slot 3 but there is no value 3, something removed the value without rewriting the list.
High NodeSlot numbers, few entries. Slots are allocated as folders get view state. A profile whose NodeSlots run into the thousands but whose BagMRU holds a handful of entries may have lost history (a heuristic; confirm with the other checks).
Recent root LastWrite on a near-empty tree. The BagMRU root key rewritten minutes before acquisition, on an otherwise busy profile, deserves a question.

2. Recoverable copies

Unallocated hive cells. Deleted keys and values often remain in free cells until overwritten. Registry Explorer shows recovered deleted keys; the ShellBags Parser does not recover them yet.
Transaction logs. UsrClass.dat.LOG1/.LOG2 can hold older states of pages.
Volume Shadow Copies and backups often contain an older UsrClass.dat. Parse both and diff.
Other hives. NTUSER.DAT has its own BagMRU tree that some cleaners ignore.

3. Evidence of the cleaner

A cleaner is a program. It shows up in Prefetch, Amcache, ShimCache, SRUM and BAM like any other. PrivaZer or CCleaner running shortly before an expected investigation is a finding on its own.

4. Cross-artifact gaps

LNK files, Jump Lists and RecentDocs pointing into folders with no ShellBags, or USB device history for a drive letter with no ShellBags on that letter, suggest the ShellBags are incomplete. Consistent gaps across several artifacts point to a cleaner or a different account.

Reporting responsibly

State what ShellBags show, for which account, with which timestamp type.
Never infer file access from a ShellBag.
Never infer innocence from absence.
When cleaning is suspected, list the specific inconsistencies, not a conclusion.

FAQ

Can ShellBags be deleted?

Yes. Any process running as the user can delete BagMRU keys, and privacy cleaners such as PrivaZer, or CCleaner with community rule files, offer ShellBags cleaning. Traces often remain: orphaned Bags keys, inconsistent MRU lists, unallocated hive cells, transaction logs, shadow copies and execution evidence of the cleaner.

Does an empty ShellBags tree mean the user did nothing?

No. Console and scripted activity never creates ShellBags, and an empty or tiny tree on an active profile is itself a reason to look for cleaning or a profile reset.