Skip to content
ShellBagsparser
Blog

Where Are ShellBags Stored? Locations and Collection

ShellBags registry locations in UsrClass.dat and NTUSER.DAT for Windows XP to 11, plus how to collect locked hives with their transaction logs, per user.

Published on 5 min read
shellbagswindows-registryacquisitiondfir

TL;DR. On Windows 7, 10 and 11, ShellBags live mainly in UsrClass.dat under Local Settings\Software\Microsoft\Windows\Shell\BagMRU (and Bags), with a second, smaller tree in NTUSER.DAT under Software\Microsoft\Windows\Shell\BagMRU. Windows XP used NTUSER.DAT only, including ShellNoRoam. Both hives are locked while the user is logged on: collect them raw, with their .LOG1 and .LOG2 files, one pair per user.

"Where are ShellBags stored" sounds like a one-line answer. In practice, most missed ShellBags I have seen in peer reviews came from collecting the wrong hive, collecting one hive out of two, or copying a hive without its transaction logs. This article is the checklist.

Registry locations by Windows version

Windows versionHiveKey path inside the hiveLive view (regedit)
XP / Server 2003NTUSER.DATSoftware\Microsoft\Windows\ShellNoRoam\BagMRU and \BagsHKCU\Software\Microsoft\Windows\ShellNoRoam
XP / Server 2003NTUSER.DATSoftware\Microsoft\Windows\Shell\BagMRU and \BagsHKCU\Software\Microsoft\Windows\Shell
Vista, 7, 8, 8.1, 10, 11UsrClass.datLocal Settings\Software\Microsoft\Windows\Shell\BagMRU and \BagsHKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell
Vista, 7, 8, 8.1, 10, 11NTUSER.DATSoftware\Microsoft\Windows\Shell\BagMRU and \BagsHKCU\Software\Microsoft\Windows\Shell

Sources: Magnet Forensics' ShellBags overview for the XP and Vista+ split, Chad Tilbury's SANS post for Windows 7, and the Velociraptor Windows.Forensics.Shellbags artifact, which searches exactly the two modern paths above.

Two practical notes:

  • UsrClass.dat is where the volume is. On modern systems the NTUSER.DAT tree is typically small (desktop items, some network entries). Do not conclude "no ShellBags" from NTUSER.DAT alone.
  • Wow6432Node. Some parsers, including the ShellBags Parser, also check Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU inside UsrClass.dat, where 32-bit shell components on 64-bit Windows can write. It is usually empty; checking costs nothing.

Hive files on disk

HivePath (Vista and later)Mounted at
UsrClass.datC:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.datHKEY_USERS\<SID>_Classes, merged into HKCU\Software\Classes
NTUSER.DATC:\Users\<user>\NTUSER.DATHKEY_USERS\<SID>, seen as HKCU

Each hive has companion transaction logs in the same folder: UsrClass.dat.LOG1, UsrClass.dat.LOG2, NTUSER.DAT.LOG1, NTUSER.DAT.LOG2. Microsoft describes the hive/file relationship in Registry Hives. AppData is hidden; UsrClass.dat and NTUSER.DAT are hidden system files.

The UsrClass root key is named after the user's SID with a _Classes suffix (S-1-5-21-...-1104_Classes). That is how a parser attributes a loose UsrClass.dat to an account even when the file was renamed. NTUSER.DAT does not carry the SID in its root name, but its Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders values point at the profile (C:\Users\<name>\Desktop), which gives the user name.

Inside the keys

...\Shell\BagMRU                 values: 0, 1, 2 (shell items), MRUListEx, NodeSlot, NodeSlots
...\Shell\BagMRU\0               children of item 0, same layout, recursively
...\Shell\Bags\<NodeSlot>\Shell  view settings for the folder whose NodeSlot = <n>
...\Shell\Bags\<NodeSlot>\ComDlg view settings saved from Open/Save dialogs
  • Numbered REG_BINARY values hold one shell item each.
  • MRUListEx is a list of 32-bit slot numbers, most recent first, terminated by 0xFFFFFFFF.
  • NodeSlot links a BagMRU key to its Bags\<n> settings key.

The shell item format and timestamps articles go deeper.

Collecting the hives

Both hives are opened exclusively by Windows while the user's profile is loaded. copy fails; some naive tools produce a file of the right size full of zeros. Methods that work:

MethodWhenNotes
KAPE with the RegistryHivesUser targetLive triageRaw reads; collects NTUSER.DAT, UsrClass.dat and their logs for every profile, keeping the Users\<name>\ structure.
VelociraptorLive, at scaleCollect the files, or run Windows.Forensics.Shellbags server-side and still keep the raw hives.
FTK Imager ("Obtain Protected Files" or file export)Single hostWorks on live systems and images.
Volume Shadow CopyLive, older stateGives you a second, earlier copy to diff against.
Disk imageOfflineExport from the mounted image (disk image parser for a quick look).

Checklist:

  1. Every profile. Walk C:\Users\*, including service and admin accounts. In intrusions, the interesting ShellBags often belong to an account nobody logs on with interactively.
  2. Both hives per user. NTUSER.DAT and UsrClass.dat.
  3. Logs next to each hive. .LOG1 and .LOG2. If the hive's base block sequence numbers differ, it is dirty and the newest writes may only be in the logs. Maxim Suhanov's registry file format specification documents the mechanism.
  4. Keep the folder structure (Users\<name>\...) or rename per user, so the analysis tool can tell accounts apart.
  5. Hash what you collected.

Dirty hives and log replay

A hive copied from a live system is often dirty. Replay the logs before a definitive analysis, for example with Eric Zimmerman's rla.exe (from his tools) or by loading the hive in Registry Explorer and saving a clean copy. SBECmd replays logs by default.

The ShellBags Parser detects dirty hives and warns you, but does not replay the logs yet. If it tells you a hive is dirty, replay it with one of the tools above and drop the cleaned hive. It also tells you when a dropped file is a transaction log, a different hive, or all zeros (the usual sign of a locked-file copy).

Quick reference

  • Modern Windows: UsrClass.dat → Local Settings\Software\Microsoft\Windows\Shell\BagMRU, plus NTUSER.DAT → Software\Microsoft\Windows\Shell\BagMRU.
  • XP: NTUSER.DAT → Software\Microsoft\Windows\ShellNoRoam\BagMRU and Shell\BagMRU.
  • Collect raw, with .LOG1 / .LOG2, every profile, both hives.

FAQ

Can I copy UsrClass.dat from a running system?

Not with a normal file copy: the hive is locked while the user's profile is loaded. Use a raw-copy tool such as KAPE, Velociraptor or FTK Imager, a Volume Shadow Copy, or a disk image.

Do I need the .LOG1 and .LOG2 files?

Yes. If the hive is dirty, recent writes are still in the transaction logs. Collect them next to the hive and replay them before trusting the newest ShellBags.

Related articles