Skip to content
ShellBagsparser
Blog

Windows ShellBags forensics

ShellBags Parser

Every folder a user browsed in Explorer — local, USB, network shares, inside ZIP files, even folders that no longer exist. Parsed in your browser with WebAssembly — nothing is uploaded.

  • NTUSER.DAT
  • UsrClass.dat
  • BagMRU
  • Rust → WebAssembly

Drop UsrClass.dat or NTUSER.DAT here

Windows 7 and later keep most ShellBags in UsrClass.dat; add NTUSER.DAT too. Folders and ZIP triage collections (KAPE, Velociraptor) work as-is, with one hive pair per user.

Synthetic hives from a fictional intrusion — no real data. How to collect ↓

100% client-side: hives are parsed by WebAssembly in your browser and never uploaded.

How to get your data

UsrClass.dat + NTUSER.DAT

You need both hives of each user, ideally with their .LOG1/.LOG2 files. Windows locks them while it runs, so use a raw copy: the first method is a single paste.

  1. CollectCopy both hives of every user, with their logs.
  2. DropDrop the C:\triage folder or the ZIP into the box above.
  3. Stays in your browserParsed locally by WebAssembly. Nothing is uploaded.

Recommended · built into Windows

Windows 10/11 or Server 2016+. Paste into PowerShell opened with “Run as administrator”. It copies every profile's hives and logs through a shadow copy (esentutl /vss); nothing to install.

PowerShell · Run as administrator
$out = 'C:\triage'
Get-ChildItem C:\Users -Directory | ForEach-Object {
  foreach ($rel in 'NTUSER.DAT', 'NTUSER.DAT.LOG1', 'NTUSER.DAT.LOG2',
      'AppData\Local\Microsoft\Windows\UsrClass.dat',
      'AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1',
      'AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2') {
    $src = Join-Path $_.FullName $rel
    if (Test-Path -LiteralPath $src) {
      $dst = Join-Path "$out\Users\$($_.Name)" $rel
      New-Item -ItemType Directory -Force -Path (Split-Path $dst) | Out-Null
      esentutl.exe /y $src /vss /d $dst
    }
  }
}
attrib -h -s "$out\*" /s /d

Result: C:\triage\Users\<name>\… for each account. Drop the C:\triage folder here, or zip it and drop the ZIP.

Gotchas

  • A normal copy of a hive in use fails or produces a file full of zeros (the tool tells you). Use one of the raw-copy methods above.
  • Dirty hive warning? Replay the .LOG1/.LOG2 with Eric Zimmerman's rla.exe or Registry Explorer, then drop the clean hive.
  • Collect every profile, service and admin accounts included, and keep the Users\<name>\ folders: renamed loose files may only be identified by SID.

What are ShellBags?

ShellBags are registry keys where Windows Explorer remembers how each folder was displayed — view mode, icon size, window position. To do that it stores, per user, an entry for every folder that was opened, in a tree that mirrors the folder hierarchy.

Because Windows keeps these entries long after the folder is gone, ShellBags prove that a user browsed to a location: a USB drive that was unplugged, a network share, the inside of a ZIP file, or a folder that was later deleted.

Where ShellBags are stored

  • Windows 7 and later: UsrClass.dat (C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat) under Local Settings\Software\Microsoft\Windows\Shell\BagMRU and Bags.
  • Also NTUSER.DAT (C:\Users\<user>\NTUSER.DAT) under Software\Microsoft\Windows\Shell\BagMRU — mostly desktop and network items.
  • Windows XP: NTUSER.DAT, Software\Microsoft\Windows\ShellNoRoam\BagMRU.
  • Each BagMRU key holds numbered values — one shell item per child folder — plus MRUListEx (most-recently-used order) and NodeSlot (link to the Bags view settings).

Why it matters in an investigation

  • Shows folders a specific user opened, even on removable media or remote shares that are no longer attached.
  • Shell items carry the folder's MFT entry and sequence number and its created, modified and accessed times as they were when browsed.
  • Browsing inside ZIP files and to network shares often reveals staging and exfiltration.

Limitations

  • Key timestamps only tell you when a key last changed; "last interacted" can only be derived for the most recently used child of each folder.
  • Shell item times use FAT format: 2-second resolution.
  • A ShellBag proves the folder was browsed in Explorer, not that files in it were opened.
  • Entries deleted from the registry (unallocated cells) are not recovered yet.

How to get the hives

  • Both hives are locked while the user is logged on: collect them with KAPE (RegistryHivesUser target), Velociraptor, FTK Imager, or from a disk image.
  • Keep the .LOG1 and .LOG2 files next to each hive: a dirty hive may be missing recent writes.
  • Name each pair by user (or keep the Users\<name>\ folder structure) so the tool can tell accounts apart.

FAQ

Is my hive uploaded anywhere?

No. The parser is Rust compiled to WebAssembly and runs in a Web Worker in your browser. There is no upload endpoint; you can use the site offline once loaded.

UsrClass.dat or NTUSER.DAT?

Both. Since Windows 7 most ShellBags are in UsrClass.dat; NTUSER.DAT holds a smaller BagMRU (desktop, some network items). Drop them together to see everything for one user.

What does "last interacted" mean?

When a folder's list of children changes order, Windows rewrites its key. The child at the top of MRUListEx was therefore the one used when the parent key was last written — that time is shown as its last interaction.

Can ShellBags show deleted folders?

Yes. Entries stay after the folder is deleted, so a folder that no longer exists on disk can still appear here, with its MFT entry and timestamps.

Is this the same as SBECmd / ShellBags Explorer?

It covers the same core fields (absolute path, shell type, MRU position, NodeSlot, MFT reference, timestamps) and exports CSV, but runs in the browser with no install.

Blog

Read the blog