shellbag

What is shellbag?

Shellbags is a set of Registry keys on Microsoft Windows that maintain information about directories when Explorer is being used. This information includes the icon, size, view, and position of the folder. They are interesting artifacts for digital forensics, as information is persisted even when the directory is deleted.