Difference between pages "Document Metadata Extraction" and "Shell Item"
From Forensics Wiki
(Difference between pages)
m (→PDF Files) |
Joachim Metz (Talk | contribs) (Created page with "The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A Shell Item is much like a "path", and is unique to its parent fol...") |
||
| Line 1: | Line 1: | ||
| − | + | The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A | |
| + | Shell Item is much like a "path", and is unique to its parent folder. The format of the Shell Item | ||
| + | is undocumented and varies between Windows versions. | ||
| − | + | The Shell Item is used in [[LNK | Windows Shortcut (LNK)]] file and the ShellBags key in the [[Windows Registry]]. | |
| − | + | == Format == | |
| − | + | ||
| − | + | The basic format is a list, consisting of a (shell item) entry size value (field) and entry data. | |
| − | + | ||
| − | + | There are multiple types of entries to specify different parts of the "path": | |
| − | : | + | * volume |
| + | * network share | ||
| + | * file and directory | ||
| + | * URI | ||
| − | + | Some shell item entries contain date and time values which can be used in [[Timeline Analysis]]. | |
| − | + | ||
| − | + | == External Links == | |
| − | + | ||
| − | + | ||
| − | + | * [http://downloads.sourceforge.net/project/liblnk/Documentation/Windows%20Shell%20Item%20format/Windows%20Shell%20Item%20format.pdf Windows Shell Item format (work in progress)] | |
| − | + | [[Category:Data Formats]] | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | [[Category: | + | |
Revision as of 03:09, 12 January 2011
The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A Shell Item is much like a "path", and is unique to its parent folder. The format of the Shell Item is undocumented and varies between Windows versions.
The Shell Item is used in Windows Shortcut (LNK) file and the ShellBags key in the Windows Registry.
Format
The basic format is a list, consisting of a (shell item) entry size value (field) and entry data.
There are multiple types of entries to specify different parts of the "path":
- volume
- network share
- file and directory
- URI
Some shell item entries contain date and time values which can be used in Timeline Analysis.
