user_parse_shellbags
Parse UsrClass.dat ShellBags to reveal folder browsing history in Windows Explorer, including timestamps and detection of suspicious paths.
Instructions
Parse ShellBags from UsrClass.dat to reveal folder navigation history. Shows which folders a user browsed in Windows Explorer with timestamps. Answers: Which folders did the user access? When did they browse suspicious paths?
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| usrclass_path | Yes | Path to UsrClass.dat (typically in Users/<user>/AppData/Local/Microsoft/Windows/UsrClass.dat) | |
| path_filter | No | Filter results by path substring (case-insensitive) | |
| suspicious_only | No | Only return suspicious folder accesses (temp, AppData, network shares, etc.) | |
| limit | No | Maximum number of results |