Introduction to Shellbag Parser

The shellbag parser is a cross-platform, open-source tool used to parse Shellbag entries from a Windows Registry hive. This tool is essential in digital forensics, as it helps investigators reconstruct user activities on a Windows system.

What are Shellbags?

Shellbags are a type of data stored in the Windows Registry that contain information about the shell namespace, including folder settings, views, and other metadata. By analyzing Shellbag entries, investigators can gain insights into a user's activities, such as the files and folders they accessed, and the programs they used.

Features of the Shellbag Parser

The shellbag parser, also known as shellbags.py, is a Python-based tool that can parse Shellbag entries from a Windows Registry hive. The tool has the following features:

• Cross-platform compatibility
• Open-source licensing under Apache 2.0
• Ability to parse Shellbag entries from a raw Windows Registry hive
• Output formatted according to the Bodyfile specification by default
• Optional output formats, including CSV
• Debugging mode with ANSI color codes

Usage

To use the shellbag parser, simply run the shellbags.py script and provide the path to a raw Windows Registry hive file as an argument. The tool will parse the Shellbag entries and output the results in the specified format.

Example Usage

$ python shellbags.py ~/projects/registry-files/willi/xp/NTUSER.DAT.copy

This will parse the Shellbag entries from the NTUSER.DAT.copy file and output the results in the default Bodyfile format.

Dependencies

The shellbag parser requires the following dependencies:

• Python 2.7
• argparse
• six
• python-registry

Sources

The shellbag parser is based on the following sources:

• "Using shellbag information to reconstruct user activities" by Yuandong Zhu, Pavel Gladyshev, and Joshua James
• "MiTeC Registry Analyzer" by Allan S Hay
• "sbag" by TZWorks
• "Shell BAG Format Analysis" by Yogesh Khatri
• "Windows Shell Item format specification" by Joachim Metz

Conclusion

The shellbag parser is a valuable tool in digital forensics, providing investigators with insights into user activities on a Windows system. With its cross-platform compatibility, open-source licensing, and flexible output formats, this tool is an essential addition to any digital forensics toolkit. For more information on digital forensics and Windows Registry analysis, visit our digital forensics page.