ShellBagger

Information about folder viewing settings when using Windows Explorer is stored in the registry, known as "shellbags". These details include the directory's size, icon, viewing mode and position, and they remain stored in the registry even after removing the folder. This means that history can be easily recalled when it comes to deleted files, USB flash drives connected to the PC, mapped drives or other mounted devices, as well as various user actions.

If you're interested in a simple method of accessing the shellbags to learn this kind of information, you can turn to ShellBagger. Designed as a tiny and portable tool, it can analyze the ntuser.dat registry hive and display info, which can be then exported to file.

Besides .NET Framework which is mandatory, the tool doesn't require setup. You can unzip the downloaded archive and just double-click the .exe to reach the main window. Because it's portable, you can add it to your collection of portable software as well as effortlessly move it between your workstations with a USB flash drive.

Unfortunately, the application is not designed to automatically identify the ntuser.dat file in the registry, which means that you have to grab it yourself and manually import it into the main window. On the bright side, this is good news if you wish to analyze the ntuser.dat of other workstations, like the ones in your local network.

The ShellBagger analysis job doesn't take long, after which you can view the registry, modified, accessed and created date of each entry related to the Windows Explorer folder options, along with the full path, source, type and size. All this info can be saved to CSV format for closer inspection.

Taking everything into account, ShellBagger offers a straightforward solution when it comes to extracting information related to Windows Explorer folder viewing preferences from the system registry.