Glossary

Plain-language definitions of the ShellBags and Windows registry terms used in our guides.

Known folder GUID

A GUID identifying a shell namespace root or special folder, such as My Computer, Network, Recycle Bin or Downloads, in root shell items.

Dirty hive

A registry hive whose primary file lacks writes still held in its .LOG1/.LOG2 transaction logs, detected by mismatched base block sequence numbers.

FAT timestamp

The DOS date and time format (two 16-bit values, 2-second resolution) used for the created, modified and accessed times inside shell items.

0xBEEF0004 extension block

The file entry extension block in shell items that adds creation and access times, an NTFS file reference and the long file name.

MFT file reference

An 8-byte NTFS identifier combining a 48-bit MFT entry number and a 16-bit sequence number, stored in many ShellBags entries.

Shell item

A binary structure the Windows shell uses to identify one component of a path, such as a drive, folder, share or Control Panel item.

NTUSER.DAT

The main per-user registry hive (HKCU). It holds the Windows XP ShellBags and, on later versions, a second, smaller BagMRU tree.

UsrClass.dat

The per-user classes registry hive that holds most ShellBags on Windows Vista and later, stored in the AppData Local folder of each profile.

MRUListEx

A binary registry value listing slot numbers in most-recently-used order, used by BagMRU keys to order their child folders.

NodeSlot

A DWORD value in each BagMRU key that links the browsed folder to its numbered view-settings key under Bags.

BagMRU

The ShellBags registry key tree that mirrors the folder hierarchy a user browsed, with one numbered shell item value per child folder.

Bags key

The ShellBags registry key holding per-folder view settings, indexed by the NodeSlot numbers referenced from BagMRU entries.

ShellBags

Registry keys in which Windows Explorer stores per-folder view settings, and with them a per-user record of every folder navigated to in the shell.