DFIRHub

ClaudeCode

Claude Code (Anthropic agentic coding CLI) session transcripts, prompt history, configuration, hooks, and IDE integration artifacts

  • Apps
  • 34 paths
  • Per-user data
  • Version 1
  • Eric Capuano

Paths on disk

34 paths

Paths use Windows environment variable syntax

Notes

Claude Code stores its state under %USERPROFILE%\.claude\ (C:\Users\<user>\.claude\) plus a single %USERPROFILE%\.claude.json.

If the CLAUDE_CONFIG_DIR environment variable is set, everything under .claude\ lives in that directory instead; check

the user's environment variables (registry: HKU\<SID>\Environment) if the default location is empty.

Primary evidence of use is projects\<project-slug>\<sessionId>.jsonl. Each line is a JSON record with type

(user, assistant, system, summary, etc), uuid, parentUuid, sessionId, cwd, gitBranch, version, timestamp and the

full message content including tool_use inputs (commands run, files written) and tool_result outputs.

history.jsonl provides a quick cross-project timeline of prompts. file-history\ contains the pre-edit copies

of every file the agent modified, keyed by session ID.

Project-level configuration also exists inside individual repositories (<repo>\CLAUDE.md, <repo>\.claude\settings.json,

<repo>\.claude\settings.local.json, <repo>\.mcp.json). Those are not collected here because their locations are

arbitrary; the project list in .claude.json and the projects\ folder names identify which directories to examine.

Deliberately not collected: .claude\.credentials.json (OAuth tokens), .claude\sessions\*.key, and the plugin

source trees under .claude\plugins\cache and .claude\plugins\repos (large, reproducible from the recorded marketplace URLs).

Folder names for the Claude Desktop embedded sessions were verified against the macOS build (Application Support\Claude)

and mapped to the equivalent Windows AppData\Roaming\Claude location.

References

6 links