Shell
Folders this user browsed in Explorer, even on USB sticks, shares and deleted folders.
Use it to prove a user browsed a folder, even on a USB stick, a network share or a folder since deleted.
- UsrClass.dat
- File and Folder Access
What It Is
ShellBags are how Explorer remembers the size, view and position of each folder window a user opens. To do that Windows records every folder the user browses, and the record stays even after the folder, the share or the USB stick has gone. It proves a user browsed to a folder, which the folder itself can no longer show once deleted. Most of it lives in the user's UsrClass.dat, under a tree called BagMRU that mirrors the folders.
What It Proves
The user browsed to that folder, on that drive letter or share, at some point. The record survives after the folder or device has gone.
What It Does Not Prove
Interaction times come from key last write times, which major updates can reset. The same path on two devices shares one entry.
Where It Lives
ShellBags lives in the UsrClass.dat hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
UsrClass.dat\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice browsed the root of E:, the drive letter the USB stick last held. Letters are reused, so confirm the device with MountedDevices and MountPoints2. |
| alice first opened E:\ |
| alice browsed a folder named export on her Desktop, which no longer exists. ShellBags outlive the folder, so look for its files in LNK files and Jump Lists. |
How to Read It
BagMRU mirrors the folder tree, so each numbered subkey is a folder, described by a shell item in its parent. Parse it with ShellBags Explorer rather than by hand, because the tool rebuilds the full paths. Look for removable drive letters, UNC paths and folders that no longer exist.
- When Windows Writes It
- When the user opens, creates, renames or copies a folder in Explorer, and as view settings change.
- Which Windows Versions
- Windows XP to 11 keep it. From Windows 7 most of it lives in UsrClass.dat.
- Tools That Parse It
- ShellBags Explorer, SBECmd, RegRipper (shellbags)
Hunt It
Folder browsing is not written to any Windows event log, so the live tools cannot see it. Collect UsrClass.dat and NTUSER.DAT and parse them, or run Velociraptor across the endpoints.
Folder browsing is not recorded. Collect UsrClass.dat and NTUSER.DAT and parse them.
Parse the Hive Instead
- Collect
C:\Users\ <user>\ AppData\ Local\ Microsoft\ Windows\ UsrClass.dat - Parse With
- ShellBags ExplorerSBECmdRegRipper (shellbags)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what ShellBags shows.
- MountPoints2Shows which volume the user had mounted, and when, to tell apart devices that share a path.
- RecentDocsShows which files and folders the user opened, with a time for the newest of each type.
- LNK Files and Jump ListsNot in the RegistryShows the files opened from those folders, with full paths and times of their own.
Sources
The facts on this page come from these public pages, which say more on each point.