Hi,
Please can anyone help with this question.
If a file name is listed within the registry at Software\Microsoft\Windows\ShellNoRoam\Bags\20\Shell\ItemPos1280x80 what does this signify?
Regards Richard
Hi Richard, I know I am sitting only 3 feet away from you ) (we work together - lol), I hope you don't mind me posting an answer - but I think I found an explanation. The Bag's store the saved Windows Explorer views. BagMRU (the key above Bags) is an index of the Bags key holders. I presume the Microsoft programmers call folders "Bags"….
BagMRU itself represents the desktop, each subkey represents a subfolder. For example a folder on the root of my C\ drive is Bag number 1304. If I open either one of them, and monitor what happens with regmon, your registry entries update if I resize the open folders and drag them about the screen.
Each numbered subkey of Bags contains the view info for a particular folder. The position is recorded in the Shell at key WinPos(X).bottom (left, right, and top). Which is a DWORD decimal value for pixel numbers.
The "Shell" key (inside the Bags folder number) represents the folder type, i.e. Documnet, Picture, Video - if this has been customised in any way.
The presence of a path to a .jpg in the Logo key, means the folder has a picture displayed in Thumbnails view and this is the thumbnail picture displayed. So if the Logo key has the path C\(folder)\illegalpicture.jpg key entry, the user would have viewed the picture on the folder.
The itemPos1280x80 relates to the contents of the folder. After the corresponding folder is opened and viewed, the key updates upon its closing (creating an audit of the folder).
The Mode key relates to the folder view in Explorer, i.e. Thumbnails (value 5), Icons (3), Details (4), Filmstrip (7) Tiles (6)…..Therefore I think Mode (with a value of 5) would be quite an interesting key….
Andy