shellbags.py

Python 3 Compatibility Fork

This is a modified version of Willi Ballenthin's shellbags.py, updated for Python 3 compatibility.

• Original repository: https://github.com/williballenthin/shellbags
• Original author: Willi Ballenthin
• License: Apache License 2.0

---

Introduction

shellbags.py is a cross-platform, open-source shellbag parser.

The webpage
http://www.williballenthin.com/forensics/shellbags/index.html
describes the algorithm in detail.

Note that shellbags.py was originally developed as a sample for python-registry, so this repository is a fork that contains the python-registry history through version v0.2.4.1.

The initial shellbags.py tag is v0.5.

---

Dependencies

shellbags.py requires:

• Python 3
• argparse
• six
• python-registry

---

Usage

shellbags.py accepts the path to a raw Windows Registry hive.
This hive should be acquired forensically.

To ensure interoperability, output is formatted according to the Bodyfile specification by default.

Parameters

usage: shellbags.py [-h] [-v] [-p] [-o {csv,bodyfile}] file [file ...]

Parse Shellbag entries from a Windows Registry.

positional arguments: file Windows Registry hive file(s)

optional arguments: -h, --help show this help message and exit -v Print debugging information while parsing -p If debugging messages are enabled, augment the formatting with ANSI color codes -o {csv,bodyfile} Output format: csv or bodyfile; default is bodyfile

Example:

$ python shellbags.py ~/projects/registry-files/willi/xp/NTUSER.DAT.copy0

0|\My Documents (Shellbag)|0|0|0|0|0|978325200|978325200|18000|978325200

0|\My Documents\Downloads (Shellbag)|0|0|0|0|0|1282762334|1282762334|18000|1281987456

0|\My Documents\My Dropbox (Shellbag)|0|0|0|0|0|1281989096|1282762296|18000|1281989050

0|\My Documents\My Music (Shellbag)|0|0|0|0|0|1281995426|1282239780|18000|1281987154

0|\My Documents\My Pictures (Shellbag)|0|0|0|0|0|1281995426|1282239780|18000|1281987152

0|\My Documents\My Dropbox (Shellbag)|0|0|0|0|0|978325200|978325200|18000|978325200

0|\My Documents\My Dropbox\Tools (Shellbag)|0|0|0|0|0|1281989092|1281989092|18000|1281989088

0|\My Documents\My Dropbox\Tools\Windows (Shellbag)|0|0|0|0|0|1281989140|1281989140|18000|1281989092

0|\My Documents\My Dropbox\Tools\Windows\7zip (Shellbag)|0|0|0|0|0|1281993604|1284668784|18000|1281989140

0|\My Documents\My Dropbox\Tools\Windows\Adobe (Shellbag)|0|0|0|0|0|1281994956|1284668784|18000|1281989140

0|\My Documents\My Dropbox\Tools\Windows\Bitpim (Shellbag)|0|0|0|0|0|1281994656|1284668784|18000|1281989140

License

shellbags.py is released under the Apache 2.0 license.

Sources

1. "Using shellbag information to reconstruct user activities" by Yuandong Zhu, Pavel Gladyshev, and Joshua James which may be accessed http://www.dfrws.org/2009/proceedings/p69-zhu.pdf
2. "MiTeC Registry Analyzer" by Allan S Hay, which may be accessed at http://mysite.verizon.net/hartsec/files/WRA_Guidance.pdf
3. "sbag" by TZWorks, which may be accessed at http://www.tzworks.net/prototype_page.php?proto_id=14
4. "Shell BAG Format Analysis" by Yogesh Khatri, which may be accessed at https://42llc.net/?p=385
5. "Windows Shell Item format specification" by Joachim Metz, which may be accessed at http://download.polytechnic.edu.na/pub4/download.sourceforge.net/pub/sourceforge/l/project/li/liblnk/Documentation/Windows%20Shell%20Item%20format/Windows%20Shell%20Item%20format.pdf