Hkcu software classes local settings software microsoft windows shell

Оригинал статьи находится здесь.

The settings for desktop icon placement in Windows XP (or Vista) are located in the the

HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop 

registry key.

This registry key contains a number of values, the most relevant if
which are the ItemPos<screenresolution> values, the Sort value and
the FFlags value.

The sort value controls the sort order of the icons (by name, by
type, by size etc.), the FFlags value controls the arrangement of the
icons (align to grid, auto align etc.)

Finally there may be any number of ItemPos values (appended with
different screen resolutions eg. ItemPos800x600), which control the user
defined positions of the icons for different screen resolutions.

For more details about the content of HKCU\Software\Microsoft\Windows\Shell values:

ShellBagsView v1.05

Картинка с сайта: itishnik.ablov.ru

Regarding the Icon view used for any folder of one’s choosing, I believe the position of icons would be stored in:

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\[x]\Shell\{yyyyyyy-yy...}\ItemPos

with ‘x’ representing one of your many folder specific settings.

Добавлю, также, что в Microsoft Windows NT Resource Kit tools есть расширение shell для сохранения и восстановления иконок десктопа, см. здесь.

You can take a backup of all the changes you have made to the Folder View settings and restore using it if the settings get reverted back or on some other computer. In this post, we will see how you can back up and restore Folder View settings in Windows 11/10.

Картинка с сайта: www.thewindowsclub.com

The Windows File Explorer is easy to navigate and comes with so many interesting accessibility features, one of which is the folder view settings. You can customize folders to represent the type of files they store.

For instance, if you have a folder where you saved only videos, you can set the folder to show thumbnails of the videos instead of a list or file details. You can also customize each folder to display medium, large, or extra-large icons.

After making these changes, you may want to back them up to restore the folder view settings if they are reset. This guide shows you how to do so using a batch file.

Follow the steps below to back up and restore your Folder View settings in Windows 11/10.

1. Create the backup-and-restore batch file.
2. Unblock the .bat file if blocked by Windows.
3. Run the .bat file to backup and restore your folder view settings.

Without further ado, we’ll now jump right into the detailed steps involved in carrying out the above operations.

1] Create the backup-and-restore batch file

Картинка с сайта: www.thewindowsclub.com

Click on the Start button and search for Notepad. Select the Notepad app from the search results to launch it.

Enter the following text in the new Notepad file:

@ECHO OFF

title Backup and Restore Folder View Settings Tool
:choice
cls
echo.
echo OPTIONS:
echo.
echo 1. Back up your folder view settings.
echo 2. Restore folder view settings from backup.
echo 3. Cancel
echo.
echo.
set /P c=Type the option number you would like to do, and press Enter?
if /I "%c%" EQU "1" goto :verify1
if /I "%c%" EQU "2" goto :verify2
if /I "%c%" EQU "3" exit
goto :choice

:verify1
IF EXIST "%userprofile%\Desktop\Folder View Settings Backup" goto :response1
goto :backup

:response1
echo.
echo.
echo You already have a "Folder View Settings Backup" folder on your desktop.
echo Please move it to another location, and try again.
echo.
pause
goto :choice

:backup
mkdir "%userprofile%\Desktop\Folder View Settings Backup"
REG EXPORT HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Defaults "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_CurrentVersion_Explorer_Streams_Defaults.reg" /y
REG EXPORT HKCU\Software\Microsoft\Windows\Shell\BagMRU "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_Shell_BagMRU.reg" /y
REG EXPORT HKCU\Software\Microsoft\Windows\Shell\Bags "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_Shell_Bags.reg" /y
REG EXPORT HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_ShellNoRoam_Bags.reg" /y
REG EXPORT HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_ShellNoRoam_BagMRU.reg" /y
REG EXPORT "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Classes_LocalSettings_Software_Microsoft_Windows_Shell_BagMRU.reg" /y
REG EXPORT "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Classes_LocalSettings_Software_Microsoft_Windows_Shell_Bags.reg" /y
cls
echo.
echo Backup of folder view settings successfully completed.
echo.
pause 
exit

:verify2
IF NOT EXIST "%userprofile%\Desktop\Folder View Settings Backup" goto :response
goto :restore

:response
echo.
echo.
echo You do not have a "Folder View Settings Backup" folder on your desktop.
echo Please place the backup folder on your desktop, and try again.
echo.
pause
goto :choice

:restore 
REG Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Defaults" /F
Reg Delete "HKCU\Software\Microsoft\Windows\Shell\BagMRU" /F
Reg Delete "HKCU\Software\Microsoft\Windows\Shell\Bags" /F
Reg Delete "HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags" /F
Reg Delete "HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU" /F
Reg Delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /F
Reg Delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /F

REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_CurrentVersion_Explorer_Streams_Defaults.reg"
REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_Shell_BagMRU.reg"
REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_Shell_Bags.reg"
REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_ShellNoRoam_Bags.reg"
REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Microsoft_Windows_ShellNoRoam_BagMRU.reg"
REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Classes_LocalSettings_Software_Microsoft_Windows_Shell_BagMRU.reg"
REG IMPORT "%userprofile%\Desktop\Folder View Settings Backup\HKCU_Software_Classes_LocalSettings_Software_Microsoft_Windows_Shell_Bags.reg"
cls
echo.
echo Backup of folder view settings successfully restored.
echo.
echo Waiting to restart explorer to apply.
echo Your screen will flash as explorer is restarted.
echo.
echo.
pause
taskkill /f /im explorer.exe
start explorer.exe 
exit

You can copy and paste the above text into the note. Next, press CTRL + S and save the file on your desktop with the .bat extension. Do this by adding .bat at the end of the filename before hitting the Save button.

Картинка с сайта: www.thewindowsclub.com

Files saved in the .bat extension are batch files and when done correctly, they’ll let you run commands on your Windows system. Learn more about batch files and explore these cool tricks.

2] Unblock the .bat file

After successfully saving the newly created file as a .bat file, Windows may block it. To run this file, you’ll need to unblock it first. To do this, right-click on the file and select Properties from the context menu.

Switch to the General tab of the Properties window and find the Unblock checkbox towards the bottom of the window. Check this box and hit the OK button to unblock the batch file.

NOTE: If the Unblock checkbox is missing in your setup, it means that Windows didn’t block the file and you can move to the next step.

3] Run the .bat file

After unblocking the .bat file, you’re good to go. You can run the .bat file by double-clicking on it. Running the batch file opens a Command Prompt window that shows you the following options:

• Back up your folder view settings.
• Restore folder view settings from backup.
• Cancel.

Картинка с сайта: www.thewindowsclub.com

To back up your folder view settings, press 1 and hit the ENTER key. If you wish to restore your folder view settings, press 2 and press ENTER.

Alternatively, press 3 to cancel the operation.

I hope this helps.

Read: How to reset Folder View in Windows 11?

How do I go back to default settings in Windows 11?

To reset your settings to default, you can reset your PC without removing the files. To do so, open Settings, go to System > Recovery, and click on Reset PC placed right next to Reset this PC option. Now, click on Keep my files and proceed.

Also Read: Reset this PC stuck in Windows 11.

Overview

The Shellbags are Windows Registry keys designed as a user experience
enhancing feature to keep track of Windows explorer graphical display settings
on a folder-by-folder basis. For instance, a Shellbag entry is used to store
the View mode of a folder (details, list, small/medium/large icons) as
well as the column displayed (entry names, dates, sizes, etc.) and their order.

Shellbags contain folders and network shares to which a given user has
navigated (using the Windows Explorer), but not the content of a directory.
Files will thus not be referenced and subdirectories will only be referenced if
they were navigated into. An exception is for ZIP files, and
other archive formats (such as tar, 7z, tgz, …) in Windows 11 (2023-09 update),
that are opened directly as folders through the Windows Explorer. Under such
activity, archive files are stored as if they were folders (with their content
thus partially referenced depending on the related activity). Shellbags
entries are also generated by access to the Control Panel settings, on an
interface-by-interface basis. The Shellbags entries related to the
Control Panel can notably be useful to detect possible Windows Firewall
(Control Panel\All Control Panel Items\Windows Defender Firewall\Customize Settings)
or Credential Manager (Control Panel\User Accounts\Credential Manager)
operations.

Various kinds of user activity may generate or update Shellbag entries (with
different level of data depending on the activity):

• First access or renaming of folders, removable devices, or network
  shares through the Windows Explorer systematically generate a
  Shellbag entry.

• Graphical opening of compressed archives or ISOs.

• Access to the Control Panel interface.

• Modification of the folder view preferences.

• Etc.

Information of interest

Shellbag entries are stored in registry as a tree-like data structure, with
the root target having the topmost BagMRU key. This allows the reconstitution
of the browsed directories arborescence. Each sub-target (subdirectory for
example) of the parent target is then represented with both:

• A registry sub-key, named with a numerical value (starting from 0).

• A registry value (in the parent target’s registry key), named with the
  same numerical value and associated with binary data that notably contains
  the target’s name.

Each Shellbag BagMRU registry key also contains:

• A MRUListEx value, that maintains the entries visited order, i.e. the
  order in which the sub-targets of a target were accessed (the last
  sub-target accessed having a MRU position of 0).

  For example, My Computer will be associated with the topmost BagMRU
  key, C: to BagMRU\0 if it was accessed first (0), C:\Users to
  BagMRU\0\1 if Users was the second folder accessed under C:\
  (1), C:\Users\USERNAME to BagMRU\0\1\0 if USERNAME was the first
  folder accessed under C:\Users, and so on and so forth. A
  hierarchical view of the Shellbag entries can thus be established.

• A NodeSlot value, containing a numerical value that references the item
  Bags sub-key. Each target is indeed associated with a sub-key under the
  HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
  key. This sub-key, named with a numerical value value corresponding to the
  NodeSlot of its associated target, contains the Explorer view settings
  for the target.

As the Shellbags entries are stored in user’s specific registry hives,
targets (folders, Control Panel interfaces, etc.) access can be tied
to a given user through its Shellbags. Shellbags entries are populated
only upon interaction (i.e. are not pre-populated), the mere presence of a
Shellbag entry for a target is thus evidence that the user interacted with
the given target. Shellbags entries are not automatically deleted upon
deletion of the related folders and can thus be a source of historical
information.

Each Shellbags entry for a given target yields the following information of
forensic interest:

• The target name and absolute path.

• The target Modified, Access, and Created (MAC) timestamps (UTC),
  retrieved from the $MFT at the Shellbag entry creation (and not further
  updated).

• Each entry in ShellBags BagMRU maintain a MRUListEx list, which
  records the order in which the sub-targets of a target were accessed
  (the last sub-target accessed having a MRU position of 0).

The first and last interacted timestamps can be indirectly deducted
for some targets:

• The First Interacted timestamp can be deduced for some targets thanks to
  the tree like data structure of ShellBags entry. Indeed, for entries that
  do not have sub-keys (i.e. directory for which no subdirectory were
  accessed) the First Interacted timestamp is equal to the key’s
  LastWriteTime timestamp. This is due to the fact that the key is created
  when a target is first accessed, and further activity for that target will
  not update the target BagMRU key’s values or its sub-keys. Indeed
  activities, such as Explorer display settings modifications, will update
  the target Bags key only (and not its BagMRU key directly). In such
  circumstances, the LastWriteTime timestamp reflect the timestamp of the
  key initial creation.

  When a sub-key is created for the target (i.e. when a subdirectory is
  accessed for that particular directory), the timestamp becomes unreliable
  as it reflect the creation of the sub-key.

• The Last Interacted timestamp can be deducted for the sub-target that was
  last interacted with. Indeed, as each Shellbag entry corresponds to
  a registry key, the key’s LastWriteTime timestamp indicates when the
  Shellbag entry was last updated. As the key is only updated when (a newly
  interacted with) sub-target is added (both as a sub-key and a numerical
  value), the LastWriteTime timestamp of a key (with sub-keys) correspond
  to the timestamp of creation of the last added sub-key. This last added
  sub-key being known, by its MRU position of 0, the interaction timestamp
  of the last interacted with child-bag/sub-target can thus be deduced (the
  parent key LastWriteTime timestamp).

Note however that major updates of the Windows operating system may result in
modification of ShellBags entries, resulting in updated last write
timestamp.

Tool(s)

ShellBagsExplorer
and SBECmd tools (KAPE associated
module SBECmd) can be used to parse ShellBags entries.

ShellBagsExplorer displays the ShellBags entries in a graphical user
interface that allow browsing of the referenced targets, in a similar manner to
Windows Explorer.

# Recursively enumerates the users' registry hives in the specified directory and parses their ShellBags entries.
SBECmd.exe --csv <CSV_DIRECTORY_OUTPUT> -d <C:\Users\<USERNAME> | C:\Users\ | DIRECTORY>

# Parses the ShellBags entries in the live registry.
SBECmd.exe --csv <CSV_DIRECTORY_OUTPUT> -l

References

• 4n6k — Shellbags Forensics: Addressing a Misconception (interpretation, step-by-step testing, new findings, and more)

• SANS — Vincent Lo — Windows ShellBag Forensics in Depth

• SANS — Chad Tilbury — Computer Forensic Artifacts: Windows 7 Shellbags

• LIFARS — Windows Shellbags Forensics

• An Important Change to ShellBags — Windows 11 2023 Update!

View on GitHub