ShellBagsView

ShellBagsView is a NirSoft utility that retrieves and displays information stored in the Windows ShellBags database. This database retains details about folder views and positions, including those that have been deleted or are no longer accessible on the system.

★★★★★

5.0(1 ratings)

• ShellBags data recovery. The tool extracts information from Windows Registry ShellBags entries, displaying details about local folders, network folders, and external devices the system has interacted with.
• Folder properties visualization. Shows attributes such as folder name, full path, modification date, size, and specific display attributes used by Windows Explorer.
• Identification of deleted folders. Can reveal information about directories that have been deleted from the system but whose configuration data remains in the registry.
• Digital forensic analysis. Provides valuable data for investigations, showing folder access history even when contents have been removed.
• Exporting results. Allows saving retrieved information in various formats such as text, HTML, XML, or CSV for further analysis or documentation.
• Advanced filtering. Includes options to filter results based on different criteria such as folder type, specific path, or date range.
• Command-line interface. Supports execution via command parameters, facilitating task automation and integration into scripts.
• Portability mode. The application does not require installation and can be run directly from a USB drive or local folder.
• Windows compatibility. Works on multiple versions of the Windows operating system, from Windows XP to Windows 11.
• MFT slot information. For NTFS volumes, displays MFT sequence numbers that can be correlated with file system records.
• USB device detection. Identifies and displays information about folders accessed on USB storage devices connected to the system.
• Network folder visualization. Retrieves details about network resources and shared folders the user has accessed.

ShellBagsView was developed by Nir Sofer, founder of NirSoft. The utility was created around 2009 as part of a suite of diagnostic and information recovery tools. The program is written primarily in C++ and leverages Windows APIs to access registry data structures.

Alternatives to ShellBagsView: