Module shellbag 

ShellBags: decode BagMRU folder-navigation history from a Windows user hive.

Windows records every folder a user browses in Explorer as a BagMRU tree. Two hives carry it: NTUSER.DAT (Software\Microsoft\Windows\Shell\BagMRU) and the per-user UsrClass.dat (Local Settings\Software\Microsoft\Windows\Shell\BagMRU). Each node is a folder; the shell-item bytes for a child folder live in the parent key as a REG_BINARY value named with the child’s numeric slot (“0”, “1”, …). The full browsed path to a node is the sequence of shell items collected walking from the root down to it.

For USB forensics the interesting subset is folders browsed on a removable / drive-letter volume (a ShellItemKind::Volume item in the path, e.g. E:\): a shellbag entry attests that E:\some\folder was browsed, which corroborates that the volume was mounted at that letter and names the directories touched on it. This decoder walks the tree, delegates shell-item parsing to the fuzzed shellitem primitive, reconstructs the path, and surfaces one ShellbagEntry per drive-letter-referencing node.

This is a reader (no findings): the forensic correlation (tying the drive letter to the physical device that carried it) lives in usb-forensic.

Robustness

The hive is attacker-controllable. Parsing is panic-free: shell-item decoding is bounds-checked by shellitem, the tree walk is iterative (no native recursion, so no stack overflow), and a visited-offset set guarantees termination on a crafted cyclic hive (a valid REGF hive is a tree).

Structs

ShellbagEntry

One browsed folder from a BagMRU tree that references a drive-letter volume.

Functions

parse_shellbags

Parse drive-letter BagMRU shellbag entries from an already-opened user hive (NTUSER.DAT or UsrClass.dat). file is recorded on each record’s Provenance. Total over a valid hive — never panics.