UsrClass.dat

UsrClass.dat is the second per-user registry hive, alongside NTUSER.DAT. Since Windows Vista it is stored at C:\Users\<username>\AppData\Local\Microsoft\Windows\UsrClass.dat. When the user logs on, Windows loads it under HKEY_USERS\<SID>_Classes and maps it into HKEY_CURRENT_USER\Software\Classes, where it holds per-user file associations and COM class registrations.

For investigators it matters mostly because of its Local Settings branch, which from Windows 7 onward holds key shell artifacts:

• ShellBags, under Local Settings\Software\Microsoft\Windows\Shell\BagMRU and Bags, recording folders the user browsed, including on removable and network drives;
• MUICache, under Local Settings\Software\Microsoft\Windows\Shell\MuiCache, listing executables whose display names the shell has read.

Per-user COM registrations under Software\Classes\CLSID are also worth reviewing, because malware can register a COM object there for persistence without administrator rights.

Like NTUSER.DAT, the hive is locked while the user is logged on, and recent changes may sit only in its transaction logs (UsrClass.dat.LOG1 and .LOG2). Because it lives in the AppData\Local folder rather than at the profile root, it is easy to miss in a hurried collection: always gather both user hives together.