UsrClass.dat / ShellBags

Location

Description

Per-user registry hive containing ShellBag entries that record folder view preferences for every folder a user browsed in Windows Explorer, including network shares, ZIP archives, removable media, and deleted folders.

Forensic Value

ShellBags persist evidence of folder access even after the folders are deleted. They record the full path of every directory browsed, including UNC paths for network shares, providing a map of what file locations the attacker explored. ShellBag timestamps include first and last interaction dates. This artifact is separate from NTUSER.DAT and often overlooked during collection. ZIP archive browsing entries prove the user opened archive files that may have contained malicious payloads.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target RegistryHives

SBECmd.exe -d C:\output --csv C:\output --csvf ShellBags.csv

Load UsrClass.dat in ShellBags Explorer (GUI) for interactive analysis

rip.exe -r "C:\Users\<username>\AppData\Local\Microsoft\Windows\UsrClass.dat" -p shellbags

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References