Skip to main content

parse_shellbags

Function parse_shellbags 

Source
pub fn parse_shellbags(
    hive: &Hive<Cursor<Vec<u8>>>,
    file: &str,
) -> Vec<ShellbagEntry>
Expand description

Parse drive-letter BagMRU shellbag entries from an already-opened user hive (NTUSER.DAT or UsrClass.dat). file is recorded on each record’s Provenance. Total over a valid hive — never panics.