ShellBags on Windows 11, 10, 7 and XP: What Changed

TL;DR. The big break is XP → Vista: ShellBags moved from NTUSER.DAT (Shell and ShellNoRoam) to UsrClass.dat (Local Settings\Software\Microsoft\Windows\Shell), and from Vista the file entry extension block carries NTFS MFT references. Windows 7 through 11 keep the same keys; what changes is the content: extension block versions (7 → 8 → 9), delegate items for profile folders, new root folders (Libraries, Quick access, OneDrive, Home), and on Windows 11 native browsing of RAR/7z/tar archives since KB5031455. Parse with a tool that knows all of them, and check odd entries against the raw bytes.

Most ShellBags confusion across Windows versions comes from analysts applying an old mental model to a new system, or a tool built for Windows 7 to a Windows 11 hive. This article is the version map. For the paths themselves and how to collect the hives, see where ShellBags are stored.

Version map

Extension versions come from the libfwsi specification, whose test set runs up to Windows 10. For Windows 11, read the version from the item itself: the ShellBags Parser shows it in the entry details. The location split between XP and Vista+ is summarised by Magnet Forensics and Chad Tilbury at SANS.

Windows XP: two trees in NTUSER.DAT

XP kept ShellBags in NTUSER.DAT under Software\Microsoft\Windows\ShellNoRoam (local, non-roaming data) and Software\Microsoft\Windows\Shell. Parse both. XP-era file entry items carry a version 3 extension block: created and accessed times and the long name, but no NTFS file reference. You cannot do the MFT-sequence check described in the deleted folders article.

XP hives still show up: legacy industrial systems, old images in cold cases, and migrated profiles that carried items forward.

Vista and 7: the move to UsrClass.dat

From Vista, the main tree lives in the per-user classes hive, UsrClass.dat, under Local Settings\Software\Microsoft\Windows\Shell. NTUSER.DAT keeps a Software\Microsoft\Windows\Shell\BagMRU tree too, generally much smaller. Two changes matter for analysis:

1. MFT references. Version 7+ extension blocks add a 48-bit MFT entry and 16-bit sequence number, which lets you tie a ShellBag to a specific NTFS record (see MFT file reference).
2. Delegate items. Windows 7 often stores folders under the user's profile as 0x74 delegate items wrapping a normal file entry (signature CFSF). Older parsers that skipped them produced paths with gaps.

Windows 7 is also where most published behavioural testing was done. 4n6k's tests on Windows 7 found that selecting a folder in Explorer can create an entry without entering it, and that the embedded times are not updated after creation. Do not assume every later build behaves identically; re-test the behaviour that your finding depends on.

Windows 8 and 8.1

No path changes. Windows 8.1 items use the version 9 extension block, which has more fields before the long name. A parser that hard-codes the version 8 offsets reads garbage names on 8.1+ items; a mismatched long name next to a correct 8.3 name is the tell.

Windows 10

Same keys, version 9 items, and more root folders. Explorer opens on Quick access, OneDrive has its own namespace root, and some builds show folders such as 3D Objects under This PC. These appear as root (0x1F) or known-folder items identified by GUID. The ShellBags Parser maps the common ones (My Computer, Network, Recycle Bin, Libraries, Quick access, OneDrive, Desktop, Documents, Downloads and others) to names and shows unknown GUIDs in braces; Microsoft's KNOWNFOLDERID page lists the documented folder IDs.

Windows 10 profiles are also where you most often find phones and cameras browsed over MTP. Those items are only partly documented; expect a readable device or folder name at best, and keep the raw hex in your notes.

Windows 11

The keys are unchanged. Differences you will see:

• Home. Recent builds open Explorer on Home, another root GUID (F874310E-B6B7-47DC-BC84-B9E6B38F5903 in the parser's table).
• Native archive browsing. Microsoft's KB5031455 release notes (October 2023, builds 22621 and 22631) add reading of .rar, .7z, .tar, .tgz and related formats via libarchive. ZIP browsing has existed for decades; the ShellBag traces left by the new formats are not yet well documented publicly. See ShellBags and ZIP files.
• Tabs. Several folders can be open in one Explorer window. That does not change the storage, but it makes "one window = one navigation" reasoning even weaker.

Things that do not change

• Navigation, not file access. True on every version. See ShellBags vs LNK, Jump Lists and RecentDocs.
• Timestamp logic. Key LastWrite plus MRUListEx works the same way everywhere. See ShellBags timestamps explained.
• Capacity limits. Windows only keeps view settings for a limited number of folders; the BagMRU Size value commonly cited as defaulting to 5,000 on Vista and later (for example by Winaero) raises it. On a busy profile, do not assume unlimited retention.
• Console blindness. cmd, PowerShell and most scripts never create ShellBags.

Practical advice for mixed estates

1. Record the OS version and build of each host with the hives (the SOFTWARE hive's CurrentVersion key has it; the registry parser reads it).
2. Expect profiles migrated between versions to contain items of several extension versions. That is normal.
3. When a new build shows unfamiliar items, compare two tools and the raw bytes before writing a sentence about them.

Related articles

• The shell item format explained
• Where ShellBags are stored and how to collect them
• ShellBags forensics: the complete guide