Glossary
Dirty hive
A registry hive whose primary file lacks writes still held in its .LOG1/.LOG2 transaction logs, detected by mismatched base block sequence numbers.
Windows writes registry changes to transaction logs (.LOG1, .LOG2) before merging them into the primary hive file. A hive copied before that merge is "dirty": the two sequence numbers in its base block differ, and the newest keys or values may exist only in the logs.
For ShellBags, that means the most recent folders can be missing. Collect the logs with the hive and replay them (for example with rla.exe) before analysis. The ShellBags Parser flags dirty hives but does not replay logs yet. See where ShellBags are stored.