UsrClass.dat — ShellBags & Per-User COM Classes

When a user browses to a folder in Windows Explorer, the operating system records the folder path, window position, view settings, and sort order in a registry structure called ShellBags. These records persist in UsrClass.dat even after the folder is deleted, the drive is disconnected, or the network share is taken offline. For investigators, ShellBags are a permanent record of every directory a user ever navigated to — a browsing history for the filesystem itself.

What Is UsrClass.dat?

UsrClass.dat is a per-user registry hive file that stores two categories of data: COM class registrations (per-user CLSID mappings for COM objects, shell extensions, and file type associations) and ShellBags (Explorer folder view state data). The hive is mapped to HKEY_CURRENT_USER\Software\Classes in the live registry. While the COM class data has limited forensic value, the ShellBags data is one of the most important artifacts for proving user interaction with specific directories.

ShellBags are stored in two key hierarchies within UsrClass.dat: Local Settings\Software\Microsoft\Windows\Shell\BagMRU (the folder tree structure, stored as a binary shellitem hierarchy) and Local Settings\Software\Microsoft\Windows\Shell\Bags (the view settings for each folder, including column widths, sort order, and view mode). The BagMRU tree mirrors the folder navigation hierarchy — each subkey represents a folder, and its value data contains a binary shell item that encodes the folder path, name, and timestamps.

ShellBags are updated when a user interacts with a folder through Windows Explorer (including Open/Save dialogs in applications). They are not created by command-line navigation (cd in cmd.exe or PowerShell), programmatic file access, or automated scripts. This specificity is both a strength and a limitation: ShellBags prove user-driven folder browsing, not programmatic access.

Location & Format

ShellBag Registry Structure

; UsrClass.dat ShellBag hierarchy
Local Settings\Software\Microsoft\Windows\Shell\
  BagMRU\              ; Root of the folder tree
    0\                 ; Desktop
      0\               ; My Computer
        0\             ; C:\ drive
          0\           ; C:\Users
            0\         ; C:\Users\jdoe
              0\       ; C:\Users\jdoe\Documents
        1\             ; E:\ drive (USB)
          0\           ; E:\Confidential
    1\                 ; Network
      0\               ; \\fileserver
        0\             ; \\fileserver\share
  Bags\                ; View settings per folder
    1\Shell\           ; View mode, sort, columns for BagMRU entry 1
    2\Shell\
    ...

What ShellBags Reveal

• Which folders did the user browse? — Every folder visited through Explorer (including File Open/Save dialogs) generates a ShellBag entry with the full path.
• Did the user browse removable media? — USB drive, SD card, and external HDD paths are recorded with drive letters. Even after the device is removed, the ShellBag persists.
• Did the user access network shares? — UNC paths (\\server\share\subfolder) are recorded in ShellBags, proving network resource access.
• When was the folder first and last accessed? — ShellBag entries contain embedded timestamps: the registry key last-write time indicates the last time the folder was browsed, and the shell item binary data contains creation and modification timestamps from the folder’s original directory entry.
• Did the user browse inside ZIP archives? — Windows Explorer treats ZIP files as browsable folders. ShellBags record navigation into ZIP archives, proving the user viewed their contents.
• What was the folder structure of deleted directories? — Since ShellBags persist after folder deletion, they reconstruct the directory hierarchy of folders that no longer exist on disk.

Forensic Use Cases

1. USB Data Theft Evidence

An employee is suspected of copying confidential files to a USB drive before resignation. The USB drive has been wiped. ShellBags in UsrClass.dat show the user browsed E:\Client_Data\2026_Q1\, E:\Client_Data\Contracts\, and E:\Client_Data\Financial_Models\. The folder names themselves reveal the type of data accessed. Combined with USBSTOR entries from the SYSTEM hive (proving the device was connected) and SRUM network data (showing transfer volumes), the ShellBags provide the directory-level browsing evidence.

2. Network Share Reconnaissance

During a post-breach investigation, ShellBags reveal the attacker (using the compromised user account) browsed \\DC01\SYSVOL\, \\FileServer\HR\, \\FileServer\Finance\Payroll\, and \\BackupServer\Backups\SQL\. This navigation pattern — domain controller shares, HR data, financial data, backup server — is consistent with reconnaissance and data staging. The ShellBag timestamps provide the exact timeline of network share browsing.

3. Deleted Folder Reconstruction

A user created a folder hierarchy (C:\Users\jdoe\Desktop\Project_Exodus\Phase1\, Phase2\, Phase3\) to stage documents, then deleted the entire folder tree. ShellBags preserve the complete hierarchy, proving the folders existed and the user browsed them. The registry key last-write timestamps show when each folder was last accessed.

4. Cloud Storage Folder Access

ShellBags record browsing of cloud sync folders (OneDrive, Dropbox, Google Drive) with their local paths. Entries for C:\Users\jdoe\Dropbox\Personal\ prove the user had a personal Dropbox folder on a corporate machine and actively browsed it. Combined with SRUM network data for the Dropbox sync process, this establishes both the existence and active use of unauthorized cloud storage.

5. Control Panel and System Settings Access

ShellBags in NTUSER.DAT (not UsrClass.dat) record access to Control Panel items and system settings. Entries showing navigation to Control Panel\Administrative Tools\Event Viewer or Control Panel\User Accounts may indicate a user was attempting system administration tasks outside their normal role, or an attacker was exploring the compromised system.

Acquisition Methods

:: Copy via reg save (only works for current user's hive)
reg save HKU\S-1-5-21-...-1001_Classes C:\Evidence\UsrClass.dat /y

:: Using KAPE (collects all user profiles)
kape.exe --tsource C: --tdest C:\Evidence --target RegistryHives

:: Using VSS for locked hive
vssadmin create shadow /for=C:
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Users\jdoe\AppData\Local\Microsoft\Windows\UsrClass.dat" C:\Evidence\

Parsing Tools & Analysis

:: Parse ShellBags with SBECmd
SBECmd.exe -d C:\Evidence\RegistryHives --csv C:\Analysis\ShellBags

:: Parse a single UsrClass.dat
SBECmd.exe --hive C:\Evidence\UsrClass.dat --csv C:\Analysis\ShellBags

:: Output: SBECmd_Output.csv with columns:
:: AbsolutePath, ShellType, Value, LastWriteTime, CreatedOn, AccessedOn, ModifiedOn

Retention & Persistence

Anti-Forensics Resilience

MITRE ATT&CK Detection Mapping

Related Artifacts & Cross-References

References

1. Eric Zimmerman, “ShellBags Explorer / SBECmd” — https://ericzimmerman.github.io/
2. SANS Institute, “Windows ShellBag Forensics” — https://www.sans.org/blog/
3. Joachim Metz, “Windows Shell Item Format Specification” — https://github.com/libyal/libfwsi
4. 13Cubed, “ShellBags for DFIR” — https://www.13cubed.com
5. Harlan Carvey, “RegRipper” — https://github.com/keydet89/RegRipper3.0