An employee workstation was compromised and the attacker used the victim's own Windows profile to search for sensitive data, browse local work folders, access a production network share, stage collected files, and prepare the collection for exfiltration. The available evidence is a focused KAPE collection rather than a full disk image, so the investigation depends heavily on user registry hives and Explorer artifacts.
Baggage is a Windows DFIR Sherlock focused on registry artifact analysis. The provided archive contains the copied KAPE output, including user hives for both admin and steve. The activity of interest is preserved primarily in Steve's hives:
The investigation can be performed with Registry Explorer, ShellBags Explorer, RECmd, RegRipper, or any parser capable of decoding ShellBag shell items. The important hives are Steve's NTUSER.DAT and UsrClass.dat, because these preserve the attacker's Explorer navigation and recently opened file activity:
This Sherlock is a Windows registry-forensics investigation. There is no need to recover deleted files or carve disk images. The registry already records enough user activity to reconstruct the attacker workflow: download an archive, extract a search tool, look for sensitive local data, open VPN and password folders, browse a production share, access dam-construction archives, stage data under Pictures, and create an exfiltration ZIP.
The central artifacts are ShellBags, RecentDocs, and MuiCache. ShellBags are the most important source because they preserve folders and shell namespace locations that were browsed in Explorer, including ZIP containers and UNC paths. RecentDocs corroborates the names of recently accessed files and shortcuts. MuiCache identifies the search utility brought in by the attacker.
The KAPE console log shows that the collection was executed with the user-registry target enabled. This explains why the evidence set is centered on registry hives rather than full filesystem contents:
The workstation name and acquisition account are useful context, but the attacker activity is visible in Steve's profile. All task timestamps below are reported in UTC and rounded to seconds, matching the challenge answer format.
This is a preview of an article or content section that is not ready to be disclosed.
It starts with limited visibility...
For this lab, load Steve's NTUSER.DAT and UsrClass.dat hives into a registry-analysis tool and review ShellBags, RecentDocs, and MuiCache. Useful techniques include reconstructing BagMRU parent-child paths, distinguishing archive container timestamps from folder timestamps, resolving UNC shell items, and correlating ShellBag LastWrite values with RecentDocs ZIP entries. The objective is to reconstruct the attacker's browsing, discovery, network-share access, staging, and exfiltration-preparation timeline from registry artifacts.