[05:06:05.351 INF] SBECmd version 2.0.0.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman
[05:06:05.351 INF] Command line: -d C:\kape_out --csv C:\kape_parsed\FileFolderAccess
[05:06:05.351 INF] Directory to process: C:\kape_out
[05:06:05.351 INF] Deduplication: false
[05:06:05.351 INF] All messages will be saved to C:\kape_parsed\FileFolderAccess\!SBECmd_Messages.txt
[05:06:05.383 INF] Processing C:\kape_out\C\Users\Administrator\NTUSER.DAT
[05:06:05.410 INF] Two transaction logs found. Determining primary log...
[05:06:05.410 INF] Primary log: C:\kape_out\C\Users\Administrator\ntuser.dat.LOG2, secondary log: C:\kape_out\C\Users\Administrator\ntuser.dat.LOG1
[05:06:05.410 INF] Replaying log file: C:\kape_out\C\Users\Administrator\ntuser.dat.LOG2
[05:06:05.410 INF] Replaying log file: C:\kape_out\C\Users\Administrator\ntuser.dat.LOG1
[05:06:05.410 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x0022. New Checksum: 0x58A8F579
[05:06:05.457 FTL] 	There was an error processing C:\kape_out\C\Users\Administrator\NTUSER.DAT. Error message: 'Software\Microsoft\Windows\Shell\BagMRU' not found in '\Users\Administrator\ntuser.dat'
[05:06:05.457 INF] Processing C:\kape_out\C\Users\Default\NTUSER.DAT
[05:06:05.457 FTL] 	There was an error processing C:\kape_out\C\Users\Default\NTUSER.DAT. Error message: 'Software\Microsoft\Windows\Shell\BagMRU' not found in 'C:\Users\Default\NTUSER.DAT'
[05:06:05.457 INF] Processing C:\kape_out\C\Users\defaultuser0\NTUSER.DAT
[05:06:05.519 INF] Parse time: 0.02 seconds
[05:06:05.519 INF] Total ShellBags found: 0
[05:06:05.519 INF] Totals by bag type
[05:06:05.519 INF] Finished processing C:\kape_out\C\Users\defaultuser0\NTUSER.DAT
[05:06:05.519 INF] Exported to: C:\kape_parsed\FileFolderAccess\defaultuser0_NTUSER.csv
[05:06:05.519 INF] ---------------------------------------------------------------------
[05:06:05.519 INF] Processing C:\kape_out\C\Users\jgartnet\NTUSER.DAT
[05:06:05.519 INF] Two transaction logs found. Determining primary log...
[05:06:05.519 INF] Primary log: C:\kape_out\C\Users\jgartnet\ntuser.dat.LOG1, secondary log: C:\kape_out\C\Users\jgartnet\ntuser.dat.LOG2
[05:06:05.519 INF] Replaying log file: C:\kape_out\C\Users\jgartnet\ntuser.dat.LOG1
[05:06:05.519 INF] Replaying log file: C:\kape_out\C\Users\jgartnet\ntuser.dat.LOG2
[05:06:05.519 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x0026. New Checksum: 0x9B7F7F9B
[05:06:05.535 FTL] 	There was an error processing C:\kape_out\C\Users\jgartnet\NTUSER.DAT. Error message: 'Software\Microsoft\Windows\Shell\BagMRU' not found in '??\C:\Users\jgartnet\ntuser.dat'
[05:06:05.535 INF] Processing C:\kape_out\C\Users\sgonk\NTUSER.DAT
[05:06:05.535 INF] Two transaction logs found. Determining primary log...
[05:06:05.535 INF] Primary log: C:\kape_out\C\Users\sgonk\ntuser.dat.LOG2, secondary log: C:\kape_out\C\Users\sgonk\ntuser.dat.LOG1
[05:06:05.535 INF] Replaying log file: C:\kape_out\C\Users\sgonk\ntuser.dat.LOG2
[05:06:05.535 INF] Replaying log file: C:\kape_out\C\Users\sgonk\ntuser.dat.LOG1
[05:06:05.535 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x0406. New Checksum: 0x3A1BD472
[05:06:05.597 INF] Parse time: 0.06 seconds
[05:06:05.597 INF] Total ShellBags found: 0
[05:06:05.597 INF] Totals by bag type
[05:06:05.597 INF] Finished processing C:\kape_out\C\Users\sgonk\NTUSER.DAT
[05:06:05.597 INF] Exported to: C:\kape_parsed\FileFolderAccess\sgonk_NTUSER.csv
[05:06:05.597 INF] ---------------------------------------------------------------------
[05:06:05.597 INF] Processing C:\kape_out\C\Users\Stanley Gonk\NTUSER.DAT
[05:06:05.644 INF] Parse time: 0.04 seconds
[05:06:05.644 INF] Total ShellBags found: 0
[05:06:05.644 INF] Totals by bag type
[05:06:05.644 INF] Finished processing C:\kape_out\C\Users\Stanley Gonk\NTUSER.DAT
[05:06:05.644 INF] Exported to: C:\kape_parsed\FileFolderAccess\Stanley Gonk_NTUSER.csv
[05:06:05.644 INF] ---------------------------------------------------------------------
[05:06:05.644 INF] Processing C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT
[05:06:05.644 INF] Two transaction logs found. Determining primary log...
[05:06:05.644 INF] Primary log: C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1, secondary log: C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2
[05:06:05.644 INF] Replaying log file: C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1
[05:06:05.644 INF] Replaying log file: C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2
[05:06:05.644 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x003F. New Checksum: 0xBA1B6CCC
[05:06:05.644 FTL] 	There was an error processing C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT. Error message: 'Software\Microsoft\Windows\Shell\BagMRU' not found in 'rofiles\LocalService\NTUSER.DAT'
[05:06:05.644 INF] Processing C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
[05:06:05.644 INF] Two transaction logs found. Determining primary log...
[05:06:05.644 INF] Primary log: C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2, secondary log: C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1
[05:06:05.644 INF] Replaying log file: C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2
[05:06:05.644 INF] Replaying log file: C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1
[05:06:05.644 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x0CD9. New Checksum: 0xA523CFBF
[05:06:05.660 FTL] 	There was an error processing C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT. Error message: 'Software\Microsoft\Windows\Shell\BagMRU' not found in 'files\NetworkService\NTUSER.DAT'
[05:06:05.660 INF] Processing C:\kape_out\C\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.660 INF] Two transaction logs found. Determining primary log...
[05:06:05.660 INF] Primary log: C:\kape_out\C\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2, secondary log: C:\kape_out\C\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
[05:06:05.660 INF] Replaying log file: C:\kape_out\C\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
[05:06:05.660 INF] Replaying log file: C:\kape_out\C\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
[05:06:05.660 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x000A. New Checksum: 0xEA1253BE
[05:06:05.806 INF] Parse time: 0.12 seconds
[05:06:05.806 INF] Total ShellBags found: 6
[05:06:05.806 INF] Totals by bag type
[05:06:05.806 INF] Directory: 3
[05:06:05.806 INF] Drive letter: 1
[05:06:05.806 INF] Root folder: GUID: 2
[05:06:05.806 INF] Finished processing C:\kape_out\C\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.806 INF] Exported to: C:\kape_parsed\FileFolderAccess\Administrator_UsrClass.csv
[05:06:05.806 INF] ---------------------------------------------------------------------
[05:06:05.806 INF] Processing C:\kape_out\C\Users\defaultuser0\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.821 INF] Parse time: 0.01 seconds
[05:06:05.821 INF] Total ShellBags found: 0
[05:06:05.821 INF] Totals by bag type
[05:06:05.821 INF] Finished processing C:\kape_out\C\Users\defaultuser0\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.821 INF] Exported to: C:\kape_parsed\FileFolderAccess\defaultuser0_UsrClass.csv
[05:06:05.821 INF] ---------------------------------------------------------------------
[05:06:05.821 INF] Processing C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.821 INF] Two transaction logs found. Determining primary log...
[05:06:05.821 INF] Primary log: C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1, secondary log: C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
[05:06:05.821 INF] Replaying log file: C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
[05:06:05.821 INF] Replaying log file: C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
[05:06:05.821 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x0007. New Checksum: 0x922C909E
[05:06:05.837 INF] Parse time: 0.00 seconds
[05:06:05.837 INF] Total ShellBags found: 4
[05:06:05.837 INF] Totals by bag type
[05:06:05.837 INF] Root folder: GUID: 3
[05:06:05.837 INF] Drive letter: 1
[05:06:05.837 INF] Finished processing C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.837 INF] Exported to: C:\kape_parsed\FileFolderAccess\jgartnet_UsrClass.csv
[05:06:05.837 INF] ---------------------------------------------------------------------
[05:06:05.837 INF] Processing C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:05.837 INF] Two transaction logs found. Determining primary log...
[05:06:05.837 INF] Primary log: C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1, secondary log: C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
[05:06:05.837 INF] Replaying log file: C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
[05:06:05.844 INF] Replaying log file: C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
[05:06:05.845 INF] At least one transaction log was applied. Sequence numbers have been updated to 0x0249. New Checksum: 0x599A3538
[05:06:06.003 INF] Parse time: 0.15 seconds
[05:06:06.003 INF] Total ShellBags found: 17
[05:06:06.003 INF] Totals by bag type
[05:06:06.003 INF] Directory: 10
[05:06:06.003 INF] Drive letter: 1
[05:06:06.003 INF] File: 1
[05:06:06.003 INF] Root folder: GUID: 5
[05:06:06.003 INF] Finished processing C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:06.003 INF] Exported to: C:\kape_parsed\FileFolderAccess\sgonk_UsrClass.csv
[05:06:06.003 INF] ---------------------------------------------------------------------
[05:06:06.003 INF] Processing C:\kape_out\C\Users\Stanley Gonk\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:06.081 INF] Parse time: 0.07 seconds
[05:06:06.081 INF] Total ShellBags found: 4
[05:06:06.081 INF] Totals by bag type
[05:06:06.081 INF] GUID: Control panel: 2
[05:06:06.081 INF] Control Panel Category: 1
[05:06:06.081 INF] Root folder: GUID: 1
[05:06:06.081 INF] Finished processing C:\kape_out\C\Users\Stanley Gonk\AppData\Local\Microsoft\Windows\UsrClass.dat
[05:06:06.081 INF] Exported to: C:\kape_parsed\FileFolderAccess\Stanley Gonk_UsrClass.csv
[05:06:06.081 INF] ---------------------------------------------------------------------
[05:06:06.081 INF] Processing complete!
[05:06:06.081 INF] Processed 13 files in 0.47 seconds!
[05:06:06.081 INF] Total ShellBags found: 31


