"Windows uses the Shellbag keys to store user preferences for GUI folder display within Windows Explorer. Everything from visible columns to display mode (icons, details, list, etc.) to sort order are tracked. If you have ever made changes to a folder and returned to that folder to find your new preferences intact, then you have seen Shellbags in action." SANS Digital Forensics and Incident Response Blog
Sumuri: Windows Shellbag Forensics
Get exclusive access to online courses and content through Patreon !