user_parse_shellbags
Parses Windows ShellBags from UsrClass.dat to reveal folder navigation history, showing browsed folders and timestamps. Identifies suspicious path access for forensic analysis.
Instructions
Parse ShellBags from UsrClass.dat to reveal folder navigation history. Shows which folders a user browsed in Windows Explorer with timestamps. Answers: Which folders did the user access? When did they browse suspicious paths?
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| usrclass_path | Yes | Path to UsrClass.dat (typically in Users/<user>/AppData/Local/Microsoft/Windows/UsrClass.dat) | |
| path_filter | No | Filter results by path substring (case-insensitive) | |
| suspicious_only | No | Only return suspicious folder accesses (temp, AppData, network shares, etc.) | |
| limit | No | Maximum number of results |