shellitem 0.1.0

Windows Shell Item / ITEMIDLIST (PIDL) parser — decode shell-item blobs from .lnk LinkTargetIDList and registry ShellBags into typed items and a reconstructed path. A reusable forensic primitive, no findings.
Documentation
1
2
3
4
5
6
7
8
9
# Changelog

## 0.1.0 — 2026-06-13

Initial release. `parse_idlist` + `reconstruct_path` over Windows `ITEMIDLIST`
(PIDL) blobs, decoding Root / Volume / FileEntry (with `0xbeef0004` long-name,
timestamps, and NTFS MFT reference) / Network / URI / ControlPanel shell items.
A reusable decoder primitive (no findings); format constants sourced from
`forensicnomicon::shellbags`. Panic-free, `forbid(unsafe_code)`, fuzzed.