Shellbag

What is a shellbag?

Shellbags is a set of Registry keys on Microsoft Windows that maintain information about directories when Explorer is being used. This information includes the icon, size, view, and position of the folder. They are interesting artifacts for digital forensics, as information is persisted even when the directory is deleted.