shellbags.py

Introduction

shellbags.py is a cross-platform, open-source shellbag parser. The webpage http://www.williballenthin.com/forensics/shellbags/index.html describes the algorithm in detail. Note that shellbags.py was originally developed as a sample for python-registry, so this repository is a fork that contains the python-registry history through version v0.2.4.1. The initial shellbags.py tag v0.5.

Dependencies

shellbags.py requires Python2.7, argparse, six and python-registry.

Usage

shellbags.py accepts the path to a raw Windows Registry hive. This hive should be acquired forensically. To ensure interoperability, output is formatted according to the Bodyfile specification by default.

Parameters: usage: shellbags.py [-h] [-v] [-p] [-o {csv,bodyfile}] file [file ...]

Parse Shellbag entries from a Windows Registry.

positional arguments: file Windows Registry hive file(s)

optional arguments: -h, --help show this help message and exit -v Print debugging information while parsing -p If debugging messages are enabled, augment the formatting with ANSI color codes -o {csv,bodyfile} Output format: csv or bodyfile; default is bodyfile

Example: $ python shellbags.py ~/projects/registry-files/willi/xp/NTUSER.DAT.copy0 0|\My Documents (Shellbag)|0|0|0|0|0|978325200|978325200|18000|978325200 0|\My Documents\Downloads (Shellbag)|0|0|0|0|0|1282762334|1282762334|18000|1281987456 0|\My Documents\My Dropbox (Shellbag)|0|0|0|0|0|1281989096|1282762296|18000|1281989050 0|\My Documents\My Music (Shellbag)|0|0|0|0|0|1281995426|1282239780|18000|1281987154 0|\My Documents\My Pictures (Shellbag)|0|0|0|0|0|1281995426|1282239780|18000|1281987152 0|\My Documents\My Dropbox (Shellbag)|0|0|0|0|0|978325200|978325200|18000|978325200 0|\My Documents\My Dropbox\Tools (Shellbag)|0|0|0|0|0|1281989092|1281989092|18000|1281989088 0|\My Documents\My Dropbox\Tools\Windows (Shellbag)|0|0|0|0|0|1281989140|1281989140|18000|1281989092 0|\My Documents\My Dropbox\Tools\Windows\7zip (Shellbag)|0|0|0|0|0|1281993604|1284668784|18000|1281989140 0|\My Documents\My Dropbox\Tools\Windows\Adobe (Shellbag)|0|0|0|0|0|1281994956|1284668784|18000|1281989140 0|\My Documents\My Dropbox\Tools\Windows\Bitpim (Shellbag)|0|0|0|0|0|1281994656|1284668784|18000|1281989140

Wanted

*) Bug reports. *) Feedback.

License

shellbags.py is released under the Apache 2.0 license.

Sources

1. "Using shellbag information to reconstruct user activities" by Yuandong Zhu, Pavel Gladyshev, and Joshua James which may be accessed http://www.dfrws.org/2009/proceedings/p69-zhu.pdf
2. "MiTeC Registry Analyzer" by Allan S Hay, which may be accessed at http://mysite.verizon.net/hartsec/files/WRA_Guidance.pdf
3. "sbag" by TZWorks, which may be accessed at http://www.tzworks.net/prototype_page.php?proto_id=14
4. "Shell BAG Format Analysis" by Yogesh Khatri, which may be accessed at https://42llc.net/?p=385
5. "Windows Shell Item format specification" by Joachim Metz, which may be accessed at http://download.polytechnic.edu.na/pub4/download.sourceforge.net/pub/sourceforge/l/project/li/liblnk/Documentation/Windows%20Shell%20Item%20format/Windows%20Shell%20Item%20format.pdf