Difference between revisions of "Shell Item"
From Forensics Wiki
Joachim Metz (Talk | contribs) |
Joachim Metz (Talk | contribs) |
||
| (10 intermediate revisions by one user not shown) | |||
| Line 1: | Line 1: | ||
The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A | The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A | ||
| − | Shell Item is much like a "path", and is unique to its parent folder. The format of the Shell Item | + | Shell Item list is much like a "path", and is unique to its parent folder. The format of the Shell Item |
is undocumented and varies between Windows versions. | is undocumented and varies between Windows versions. | ||
| Line 71: | Line 71: | ||
shell item long name : calc.exe | shell item long name : calc.exe | ||
</pre> | </pre> | ||
| + | |||
| + | == See Also == | ||
| + | * [[Jump Lists]] | ||
| + | * [[LNK]] | ||
== External Links == | == External Links == | ||
| − | * [http:// | + | * [http://msdn.microsoft.com/en-us/library/windows/desktop/cc144090(v=vs.85).aspx MSDN: Introduction to the Shell Namespace (Windows)] |
| + | * [http://netez.com/2xExplorer/shellFAQ/bg_shell.html Fundamental Shell Concepts] | ||
| + | * [http://mysite.verizon.net/hartsec/files/WRA_Guidance.pdf MiTeC Registry Analyser], by [[Allan Hay|Allan S Hay]], December 2004 | ||
| + | * [http://computer-forensics.sans.org/blog/2008/10/31/shellbags-registry-forensics/ ShellBags Registry Forensics], by johnmccash, October 2008 | ||
| + | * [http://42llc.net/?p=385 Shell Bag Format Analysis], by [[Yogesh Khatri]], October 2009 (appears to be no longer available) | ||
| + | * [http://code.google.com/p/liblnk/downloads/detail?name=Windows%20Shell%20Item%20format.pdf Windows Shell Item format], by the [[liblnk|liblnk project]], July 2010 (work in progress) | ||
| + | * [http://www.williballenthin.com/forensics/shellbags/index.html Windows shellbag forensics], by [[Willi Ballenthin]] | ||
| + | * [http://code.google.com/p/regripper/wiki/ShellBags RegRipper - ShellBags], by [[Harlan Carvey]] | ||
| + | * [http://volatility-labs.blogspot.ca/2012/09/movp-32-shellbags-in-memory-setregtime.html MoVP 3.2 Shellbags in Memory, SetRegTime, and TrueCrypt Volumes], [[Jamie Levy]], September 2012 | ||
| + | * [http://windowsir.blogspot.ch/2012/10/shellbag-analysis-revisitedsome-testing.html Shellbag Analysis, Revisited...Some Testing], by [[Harlan Carvey]], October 2012 | ||
| + | * [http://tech.groups.yahoo.com/group/win4n6/message/7623 Shellbag research], by [[Sebastien Bourdon-Richard]], October 2012 | ||
[[Category:Data Formats]] | [[Category:Data Formats]] | ||
Latest revision as of 07:45, 10 February 2013
The Windows Shell uses Shell Items (or Shell Item list) to identify items within the Windows Folder Hierarchy. A Shell Item list is much like a "path", and is unique to its parent folder. The format of the Shell Item is undocumented and varies between Windows versions.
The Shell Item is used in Windows Shortcut (LNK) file and the ShellBags key in the Windows Registry.
Contents |
[edit] Format
The basic format is a list, consisting of a (shell item) entry size value (field) and entry data.
There are multiple types of entries to specify different parts of the "path":
- volume
- network share
- file and directory
- URI
Some shell item entries contain date and time values which can be used in Timeline Analysis.
[edit] Example
An example of a shell item list taken from Calculator.lnk
shell item type : 0x1f
shell item flags : 0x50
shell item folder identifier : 20d04fe0-3aea-1069-a2d8-08002b30309d
shell item folder name : My Computer
shell item type : 0x2f
shell item volume name : C:\
shell item type : 0x31
shell item flags : 0x00
shell item file size : 0
shell item modification time : Dec 31, 2010 13:28:48 UTC
shell item file attribute flags : 0x0010
Is directory (FILE_ATTRIBUTE_DIRECTORY)
shell item short name : WINDOWS
shell item extension size : 38
shell item extension version : 3
shell item creation time : Dec 31, 2010 13:26:18 UTC
shell item access time : Dec 31, 2010 13:28:52 UTC
shell item long name : WINDOWS
shell item type : 0x31
shell item flags : 0x00
shell item file size : 0
shell item modification time : Dec 31, 2010 13:28:38 UTC
shell item file attribute flags : 0x0010
Is directory (FILE_ATTRIBUTE_DIRECTORY)
shell item short name : system32
shell item extension size : 40
shell item extension version : 3
shell item creation time : Dec 31, 2010 13:26:18 UTC
shell item access time : Dec 31, 2010 13:28:38 UTC
shell item long name : system32
shell item type : 0x32
shell item flags : 0x00
shell item file size : 115712
shell item modification time : Mar 25, 2003 12:00:00 UTC
shell item file attribute flags : 0x0020
Should be archived (FILE_ATTRIBUTE_ARCHIVE)
shell item short name : calc.exe
shell item extension size : 40
shell item extension version : 3
shell item creation time : Dec 31, 2010 13:06:06 UTC
shell item access time : Dec 31, 2010 13:06:06 UTC
shell item long name : calc.exe
[edit] See Also
[edit] External Links
- MSDN: Introduction to the Shell Namespace (Windows)
- Fundamental Shell Concepts
- MiTeC Registry Analyser, by Allan S Hay, December 2004
- ShellBags Registry Forensics, by johnmccash, October 2008
- Shell Bag Format Analysis, by Yogesh Khatri, October 2009 (appears to be no longer available)
- Windows Shell Item format, by the liblnk project, July 2010 (work in progress)
- Windows shellbag forensics, by Willi Ballenthin
- RegRipper - ShellBags, by Harlan Carvey
- MoVP 3.2 Shellbags in Memory, SetRegTime, and TrueCrypt Volumes, Jamie Levy, September 2012
- Shellbag Analysis, Revisited...Some Testing, by Harlan Carvey, October 2012
- Shellbag research, by Sebastien Bourdon-Richard, October 2012
