Take the State of DFIR Survey Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey

Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
Windows XP Shellbag...
 
Notifications
Clear all

Windows XP Shellbags

4 Posts
2 Users
0 Reactions
1,007 Views
(@cedricpernet)
Eminent Member
Joined: 17 years ago
Posts: 26
Topic starter   [#8845]

Hi all,

I am currently discovering the interesting world of Windows shellbags. I am a bit surprised about something.

I am doing some tests on a Windows XP (in a VirtualBox environment) and I see that almost no "itempos" entries in

HKCU\<user id>\Software\Microsoft\Windows\Shell\Bags\<anybag>

or in

HKCU\<user id>\Software\Microsoft\Windows\ShellNoRoam\Bags\<anybag>

although I see a lot of WinPos or MinPos/MaxPos …

I try to access folders using the Explorer, move windows around, resize them etc.

Is this the result of some Windows Explorer parameters ? Any hint on why I don't see ItemPos subkeys ?

Thank you !



   
Quote
(@cedricpernet)
Eminent Member
Joined: 17 years ago
Posts: 26
Topic starter  

Well checking the behaviour when accessing folders (with Process Monitor), I see a lot of events happening on a bag, looking fine to me, but it ends with a "RegDeleteValue" on the ItemPos (in HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\21\Shell\ItemPos1680x915(1) as an example)

Process Monitor shows a result "NAME NOT FOUND" on that operation.

Why is that ? (Same for every bag)



   
ReplyQuote
(@cedricpernet)
Eminent Member
Joined: 17 years ago
Posts: 26
Topic starter  

After a while digging in the registry, I thought I should watch Windows Explorer behaviour more.

What I found out is that on my XP there seem to be no possibility to make Internet Explorer "remember" each folder windows position/size. Therefore, that's no wonder that I see no "ItemPos" entry in the shellbags.

This has driven me crazy for some days already -/

Could anyone help me out and tell me how to get Windows Explorer to finally behave the way I want and store "ItemPos" in the Shellbags ?

Thank you -)



   
ReplyQuote
(@yogeshkhatri)
Eminent Member
Joined: 17 years ago
Posts: 26
 

This has got to be a file/folder setting and / or a policy setting. Possibly (maybe accidently) turned on by some malware?



   
ReplyQuote

Enterprise Partners

  • semantics21 2026 FF logo
  • MagnetForensics_ForensicFocus
  • celebrite-logo
  • atola-logo

Partners

  • detego-logo
  • Logo_MSAB_Black (2)
  • ADF
  • gmdsoft-logo
  • Aid4Mail-Logo
  • logo Belkasoft 135x100

Academic Partners

  • University of Southampton logo 2
Share: