ShellBags vs LNK Files, Jump Lists and RecentDocs
Four user-activity artifacts compared: what ShellBags, LNK files, Jump Lists and RecentDocs each record, what they prove, their timestamps and blind spots.
TL;DR. ShellBags answer "which folders did this user browse?". LNK files and Jump Lists answer "which files (and folders) did this user open, from which application, and when?". RecentDocs answers "what did the user open recently, by extension?" in a compact registry form. All four are per-user and all four use the same shell item format. They are co-witnesses: ShellBags give breadth over folders, the others give depth over files.
When I review a user-activity timeline, the most common structural mistake is using one of these as a substitute for another: "no LNK file, so the user never went there", or "ShellBags show the folder, so the user opened the spreadsheet". This article sets out what each one can carry.
At a glance
| ShellBags | LNK files | Jump Lists | RecentDocs | |
|---|---|---|---|---|
| Storage | UsrClass.dat + NTUSER.DAT, Shell\BagMRU | %APPDATA%\Microsoft\Windows\Recent\*.lnk | ...\Recent\AutomaticDestinations\*.automaticDestinations-ms, CustomDestinations\*.customDestinations-ms | NTUSER.DAT Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs |
| Unit recorded | Folder | Target file or folder | Item per application (AppID) | File or folder name, per extension |
| Created by | Navigating/selecting folders in Explorer and common dialogs | Opening a file through the shell | Opening items with an app that uses jump lists | Shell "recent documents" tracking (SHAddToRecentDocs) |
| Key times | Key LastWrite, MRU-derived last interacted, embedded folder MAC | LNK file created/modified, target's MAC times | DestList last access per entry | Key LastWrite + MRUListEx order |
| Extra context | MFT reference of the folder, UNC path, archive path | Volume serial, drive type, NetBIOS name, MAC of host (tracker block) | Application identity, access count on recent versions, embedded LNK data | Order of use per extension |
| Proves file access | No | Yes | Yes | Yes |
| Survives target deletion | Yes | Yes | Yes | Yes |
Structure references: MS-SHLLINK for LNK, libyal's Jump lists format, and the libfwsi shell item format shared by all four. The SANS Windows Forensic Analysis poster groups them under "file/folder opening".
When ShellBags win
- Browsing without opening. A user who looks through a share to see what is there, or checks that a copy to USB completed, often opens nothing. Only ShellBags remember.
- Folder-level breadth. Every parent of every browsed path is recorded. You see the structure of a removable drive the user explored, not just the one file they opened.
- Longevity. LNK files in
Recentare pruned and Jump List entries age out per application. ShellBags persist much longer on a typical profile (subject to the limits in ShellBags limitations). - Deleted folders. The MFT reference in the shell item lets you test whether the folder's record was reused. See deleted folders.
When LNK files and Jump Lists win
- File-level proof. They name the file that was opened. ShellBags cannot.
- Device identity. LNK files carry the volume serial number and drive type of the target, which ties an opened file to a specific USB volume. A ShellBag gives you a drive letter only.
- Application context. A Jump List is per AppID, so you know the file was opened in, say, the default ZIP handler or a remote desktop client.
- Better times for the file. LNK creation time approximates first open, modification time approximates last open (through that shortcut).
When RecentDocs helps
RecentDocs is a compact per-user index of recently opened items, with one subkey per extension and a Folder subkey, each with its own MRUListEx. It is useful to sort "what was opened most recently" by type and to spot extensions that do not fit the user (.ps1, .7z, .kdbx). It stores names, not full paths, so pair it with LNK files for the path. Related registry lists under ComDlg32 (OpenSavePidlMRU, LastVisitedPidlMRU) record files and folders used in Open/Save dialogs, per extension and per application.
Using them together: a pattern
A hypothetical sequence, extending the site's fictional sample (the file name and LNK details are invented for illustration):
- ShellBags place the user in
\\FILESRV01\Finance\Boardat 10:36 (MRU-derived). - LNK/Jump Lists show
Q3_board_pack.pdffrom that share opened at 10:37. - RecentDocs
.pdfsubkey has the same name at position 0. - ShellBags then show
E:\exfil\finance_2026browsed at 10:45; an LNK file for a file in that folder carries the E: volume serial number, which you match against the USB device history in the SYSTEM hive and event logs (EVTX parser).
Each artifact covers the others' gaps. Missing one does not make the story false; it tells you where to look next.
Reading the absence
- ShellBag present, no LNK. The folder was browsed; either no file was opened through the shell, the LNK was pruned, or it was deleted. Not evidence of file access.
- LNK present, no ShellBag for its folder. The file may have been opened from a path the user never browsed (a link in an email, a command line, an application's recent list), or ShellBags were cleaned.
- Neither. Consider console or scripted activity, a different account, or anti-forensics. Program execution artifacts such as Prefetch, Amcache and the SRUM database can show which tools ran.
FAQ
Which artifact proves a file was opened, ShellBags or LNK files?
LNK files, Jump Lists and RecentDocs record opened files. ShellBags only record folders that were navigated to or selected.
Why pull ShellBags if I already have LNK files?
Because users browse many folders without opening a file in them, and ShellBags keep those folders, including on removable media and shares, after the LNK files have rotated out or been deleted.