Difference between pages "Document Metadata Extraction" and "Shell Item"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (PDF Files)
 
 
Line 1: Line 1:
Here are tools that will extract metadata from document files.
+
The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A
 +
Shell Item is much like a "path", and is unique to its parent folder. The format of the Shell Item
 +
is undocumented and varies between Windows versions.
  
=Office Files=
+
The Shell Item is used in [[LNK | Windows Shortcut (LNK)]] file and the ShellBags key in the [[Windows Registry]].
  
; [[antiword]]
+
== Format ==
: http://www.winfield.demon.nl/
+
  
; [[catdoc]]
+
The basic format is a list, consisting of a (shell item) entry size value (field) and entry data.
: http://www.45.free.net/~vitus/software/catdoc/
+
  
; [[laola]]
+
There are multiple types of entries to specify different parts of the "path":
: http://user.cs.tu-berlin.de/~schwartz/pmh/index.html
+
* volume
 +
* network share
 +
* file and directory
 +
* URI
  
; [[word2x]]
+
Some shell item entries contain date and time values which can be used in [[Timeline Analysis]].
: http://word2x.sourceforge.net/
+
  
; [[wvWare]]
+
== Example ==
: http://wvware.sourceforge.net/
+
An example of a shell item list taken from '''Calculator.lnk'''
: Extracts metadata from various [[Microsoft]] Word files ([[doc]]). Can also convert doc files to other formats such as HTML or plain text.
+
  
=PDF Files=
+
<pre>
 +
shell item type                    : 0x1f
 +
shell item flags                    : 0x50
 +
shell item folder identifier        : 20d04fe0-3aea-1069-a2d8-08002b30309d
 +
shell item folder name              : My Computer
  
; [[xpdf]]
+
shell item type                    : 0x2f
: http://www.foolabs.com/xpdf/
+
shell item volume name              : C:\
: [[pdfinfo]] (part of the [[xpdf]] package) displays some metadata of [[PDF]] files.
+
  
 +
shell item type                    : 0x31
 +
shell item flags                    : 0x00
 +
shell item file size                : 0
 +
shell item modification time        : Dec 31, 2010 13:28:48 UTC
 +
shell item file attribute flags    : 0x0010
 +
        Is directory (FILE_ATTRIBUTE_DIRECTORY)
  
; [[pdfimages]]
+
shell item short name              : WINDOWS
: Part of [http://www.foolabs.com/xpdf xpdf], this program will strip all of the images out of a PDF file and put each in its own file.
+
shell item extension size          : 38
 +
shell item extension version        : 3
 +
shell item creation time            : Dec 31, 2010 13:26:18 UTC
 +
shell item access time              : Dec 31, 2010 13:28:52 UTC
 +
shell item long name                : WINDOWS
  
=Images=
+
shell item type                    : 0x31
 +
shell item flags                    : 0x00
 +
shell item file size                : 0
 +
shell item modification time        : Dec 31, 2010 13:28:38 UTC
 +
shell item file attribute flags    : 0x0010
 +
        Is directory (FILE_ATTRIBUTE_DIRECTORY)
  
; [[jhead]]
+
shell item short name              : system32
: http://www.sentex.net/~mwandel/jhead/
+
shell item extension size          : 40
: Displays or modifies [[Exif]] data in [[JPEG]] files.
+
shell item extension version        : 3
 +
shell item creation time            : Dec 31, 2010 13:26:18 UTC
 +
shell item access time              : Dec 31, 2010 13:28:38 UTC
 +
shell item long name                : system32
  
; [[vinetto]]
+
shell item type                    : 0x32
: http://vinetto.sourceforge.net/
+
shell item flags                    : 0x00
: Examines [[Thumbs.db]] files.
+
shell item file size                : 115712
 +
shell item modification time        : Mar 25, 2003 12:00:00 UTC
 +
shell item file attribute flags    : 0x0020
 +
        Should be archived (FILE_ATTRIBUTE_ARCHIVE)
  
;[[libexif]]
+
shell item short name              : calc.exe
: http://sourceforge.net/projects/libexif EXIF tag Parsing Library
+
shell item extension size          : 40
 +
shell item extension version        : 3
 +
shell item creation time            : Dec 31, 2010 13:06:06 UTC
 +
shell item access time              : Dec 31, 2010 13:06:06 UTC
 +
shell item long name                : calc.exe
 +
</pre>
  
=General=
+
== External Links ==
These general-purpose programs frequently work when the special-purpose programs fail, but they generally provide less detailed information.
+
  
; [[Metadata Assistant]]
+
* [http://downloads.sourceforge.net/project/liblnk/Documentation/Windows%20Shell%20Item%20format/Windows%20Shell%20Item%20format.pdf Windows Shell Item format (work in progress)]
: http://www.payneconsulting.com/products/metadataent/
+
  
; [[hachoir|hachoir-metadata]]
+
[[Category:Data Formats]]
: Extraction tool, part of '''[[Hachoir]]''' project
+
 
+
; [[file]]
+
: The UNIX '''file''' program can extract some metadata
+
 
+
; [[GNU libextractor]]
+
: http://gnunet.org/libextractor/ The libextractor library is a plugable system for extracting metadata
+
 
+
[[Category:Tools]]
+

Revision as of 03:14, 12 January 2011

The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A Shell Item is much like a "path", and is unique to its parent folder. The format of the Shell Item is undocumented and varies between Windows versions.

The Shell Item is used in Windows Shortcut (LNK) file and the ShellBags key in the Windows Registry.

Format

The basic format is a list, consisting of a (shell item) entry size value (field) and entry data.

There are multiple types of entries to specify different parts of the "path":

  • volume
  • network share
  • file and directory
  • URI

Some shell item entries contain date and time values which can be used in Timeline Analysis.

Example

An example of a shell item list taken from Calculator.lnk

shell item type                     : 0x1f
shell item flags                    : 0x50
shell item folder identifier        : 20d04fe0-3aea-1069-a2d8-08002b30309d
shell item folder name              : My Computer

shell item type                     : 0x2f
shell item volume name              : C:\

shell item type                     : 0x31
shell item flags                    : 0x00
shell item file size                : 0
shell item modification time        : Dec 31, 2010 13:28:48 UTC
shell item file attribute flags     : 0x0010
        Is directory (FILE_ATTRIBUTE_DIRECTORY)

shell item short name               : WINDOWS
shell item extension size           : 38
shell item extension version        : 3
shell item creation time            : Dec 31, 2010 13:26:18 UTC
shell item access time              : Dec 31, 2010 13:28:52 UTC
shell item long name                : WINDOWS

shell item type                     : 0x31
shell item flags                    : 0x00
shell item file size                : 0
shell item modification time        : Dec 31, 2010 13:28:38 UTC
shell item file attribute flags     : 0x0010
        Is directory (FILE_ATTRIBUTE_DIRECTORY)

shell item short name               : system32
shell item extension size           : 40
shell item extension version        : 3
shell item creation time            : Dec 31, 2010 13:26:18 UTC
shell item access time              : Dec 31, 2010 13:28:38 UTC
shell item long name                : system32

shell item type                     : 0x32
shell item flags                    : 0x00
shell item file size                : 115712
shell item modification time        : Mar 25, 2003 12:00:00 UTC
shell item file attribute flags     : 0x0020
        Should be archived (FILE_ATTRIBUTE_ARCHIVE)

shell item short name               : calc.exe
shell item extension size           : 40
shell item extension version        : 3
shell item creation time            : Dec 31, 2010 13:06:06 UTC
shell item access time              : Dec 31, 2010 13:06:06 UTC
shell item long name                : calc.exe

External Links