01Location
- NTUSER.DAT: Software\Microsoft\Windows\Shell\BagMRU and \Bags
- NTUSER.DAT: Software\Microsoft\Windows\ShellNoRoam\BagMRU
- UsrClass.dat (Vista+): Local Settings\Software\Microsoft\Windows\Shell\BagMRU and \Bags
- UsrClass.dat (Vista+): Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
- C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat
02Questions it answers
- Which folders (local, removable, network, archive) did a user open in Explorer?
- Did a folder exist that is no longer present on the system?
- What creation, modification and last-access times did the folder have when the item was stored?
- Within which time bounds did a ShellBag key change?
03Format and versions
| Format | BagMRU sub-keys form a hierarchy similar to the folder structure. Numbered REG_BINARY values hold shell items (IDList), ordered by MRUListEx (4-byte little-endian indices, most recent first); NodeSlot links to Bags\<n>\Shell view settings. File-entry shell items carry FAT date/time values; extension block 0xbeef0004 adds creation and last-access FAT times, the long name and, from extension version 7, an NTFS file reference. |
|---|---|
| Applies to | Windows XP and later; additional UsrClass.dat locations from Windows Vista. Extension block version 3 = XP/2003, 7 = Vista, 8 = 2008/7/8.0, 9 = 8.1/10. |
04Key fields
| Field | What it tells you |
|---|---|
| BagMRU numbered value | Shell item describing one path component (folder, drive, network location, etc.). |
| MRUListEx | Order of the numbered values, most recent first. |
| NodeSlot | Bag number linking to the corresponding Bags\<n> sub-key. |
| File entry shell item | File size, last modification FAT time, lower 16 bits of attribute flags, primary (often short) name. |
| Extension block 0xbeef0004 | Creation and last-access FAT times, long name, localized name and (v7+) NTFS file reference. |
| Bags\<n>\Shell | View settings such as Mode, Sort, FolderType and window positions. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Shell item last modification time | FAT date/time (UTC) | Folder metadata captured with the shell item; libfwsi notes these values are not always set. |
| 0xbeef0004 creation / last access | FAT date/time (UTC) | Present in extension blocks written on Windows XP and later. |
| BagMRU key last written time | FILETIME (UTC) | Changes only when key content changes; a value rewrite with identical data may leave it unchanged. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect NTUSER.DAT and UsrClass.dat with transaction logs for every profile.
- Walk the BagMRU tree recursively and rebuild full paths by concatenating shell items from the root.
- Decode shell item types and extension blocks; record NTFS file references for comparison with $MFT.
- Use MRUListEx order and key last written times as bounds, then corroborate with LNK files, Jump Lists and USB history.
07Interpretation pitfalls
- Entries exist only for folders opened and closed in Windows Explorer at least once.
- Entries remain after the folder is deleted, and a new folder with the same name and path can inherit the previous folder's MRU key.
- Shell item formats are undocumented by Microsoft and vary between Windows versions.
09Sources
- Most recently used (MRU) libyal / winreg-kb · checked 2026-10-14
- Windows Shell Item format libyal / libfwsi (J. Metz) · checked 2026-10-14
- Using shellbag information to reconstruct user activities, Digital Investigation 6 (2009) S69–S77 Y. Zhu, P. Gladyshev, J. James — DFRWS 2009 · checked 2026-10-14
- Windows NT Registry File (REGF) format libyal / libregf (J. Metz) · checked 2026-10-14