# Shellbags Parser

Parse Windows shellbags from a registry hive pasted as hex or Base64: walk BagMRU, decode shell items and rebuild the folder paths a user browsed, deleted ones included.

## Run it

- **CLI:** `gizza tool shellbags-parser 'Paste hex bytes starting with 72 65 67 66 (ASCII "regf"), or switch the encoding below to Base64'`
- **Web:** https://gizza.ai/tools/shellbags-parser/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/shellbags-parser/tool.json

## Inputs

- `data` — Hive bytes _(field)_
- `input_encoding` — Input encoding _(field)_
- `mode` — Output format _(field)_
- `bag_root` — Shellbag root _(field)_
- `custom_path` — Custom BagMRU path (optional) _(field)_
- `max_entries` — Maximum entries _(field)_
- `max_depth` — Maximum folder depth _(field)_
- `resolve_guids` — Resolve known GUIDs to friendly names _(field)_

## Output

- Shellbag entries (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `data` — Hive bytes
- `input_encoding` — Input encoding
- `mode` — Output format
- `bag_root` — Shellbag root
- `custom_path` — Custom BagMRU path (optional)
- `max_entries` — Maximum entries
- `max_depth` — Maximum folder depth
- `resolve_guids` — Resolve known GUIDs to friendly names

Example: `https://gizza.ai/tools/shellbags-parser/?data=Paste%20hex%20bytes%20starting%20with%2072%2065%2067%2066%20%28ASCII%20%22regf%22%29%2C%20or%20switch%20the%20encoding%20below%20to%20Base64&input_encoding=hex&mode=tree&bag_root=auto&custom_path=Local%20Settings%5CSoftware%5CMicrosoft%5CWindows%5CShell%5CBagMRU&max_entries=200&max_depth=32&resolve_guids=true`

---

## About this tool

Shellbags Parser is a local DFIR helper for offline Windows shellbag analysis. Paste a `UsrClass.dat` or Windows XP `NTUSER.DAT` hive encoded as hex or Base64, then reconstruct the folder paths recorded under the `BagMRU` tree. Shellbags are useful because they can preserve folders that no longer exist, removable-drive paths, and network locations that Explorer or file dialogs browsed in the past.

The parser walks known shellbag roots, follows `MRUListEx` ordering, decodes common shell item classes (root GUID folders, volumes, file entries, network locations, URI/control-panel/delegate items), and reports `NodeSlot`, MRU position, shell-item timestamps, key last-write time, and NTFS MFT references when a `0xBEEF0004` extension block carries one. Output can be an indented tree, a flat path list, CSV, Sleuth Kit bodyfile lines, or raw per-item diagnostics for damaged and vendor-specific shell items.

### Worked example

To reconstruct a tree from a `UsrClass.dat` file after installing the CLI:

```bash
gizza tool shellbags-parser --data "$(xxd -p -c 256 UsrClass.dat)" --input-encoding hex --mode tree --bag-root auto --max-entries 200 --max-depth 32
```

For a quick smoke test without a hive, paste `72656766` with the default hex encoding. The tool should reject it as a truncated registry hive and explain that a full `regf` base block is required.

### Limits and edge cases

- This tool reads one pasted hive at a time. It does not read from live registry paths, mounted disk images, directories of profiles, or multiple correlated hives.
- It does not replay `.LOG`, `.LOG1`, or `.LOG2` registry transaction logs, so a dirty hive may miss the newest shellbag entries until logs are replayed with a forensic workstation.
- Shellbags record folders browsed by Explorer and common dialogs; they do not prove a file inside the folder was opened or that access succeeded.
- Shell-item MAC timestamps describe the folder item as recorded in the shellbag, not necessarily the exact browse time. Registry key last-write time is usually the better interaction proxy.
- Unknown shell item classes are reported with their class byte and a hex preview instead of guessed names.

## FAQ

<details>
<summary>Do I paste a file path or the hive bytes?</summary>

Paste the hive bytes encoded as hex or Base64. Browser and chat blocks cannot read your local disk path directly, so encode the file first with a command such as `xxd -p -c 256 UsrClass.dat` or `base64 -w0 UsrClass.dat`.

</details>

<details>
<summary>Which hive should I use for shellbags?</summary>

On Windows Vista and later, start with the user's `UsrClass.dat`; the default auto mode checks `Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU`. For Windows XP, shellbags are commonly in `NTUSER.DAT` under `Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU` or `Software\\Microsoft\\Windows\\Shell\\BagMRU`.

</details>

<details>
<summary>Why does the output include folders that no longer exist?</summary>

That is one of the reasons shellbags are useful. Explorer stores view settings for folders it has seen, so the registry can retain paths from deleted folders, disconnected USB drives, or unavailable network shares.

</details>

<details>
<summary>Can this tell exactly when a user opened a folder?</summary>

Not exactly. The tool reports shell-item timestamps and the registry key last-write time, but shellbags are view-preference artifacts rather than a precise audit log. Treat times as corroborating evidence and compare them with filesystem, LNK, Jump List, and event-log timelines.

</details>

## Related tools

- [Amcache Parser](https://gizza.ai/tools/amcache-parser/): Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.
- [Registry Hive Parser](https://gizza.ai/tools/registry-hive-parser/): Parse offline Windows registry hive bytes from hex or Base64, inspect regf header integrity, browse keys and values, and sweep Run/RunOnce autostart locations locally.
- [USN Journal Parser](https://gizza.ai/tools/usnjrnl-parser/): Parse an NTFS $UsnJrnl:$J change journal from hex or Base64 and list file create, rename, write and delete events with UTC timestamps, locally.
- [Memory Strings Extractor](https://gizza.ai/tools/memory-strings/): Extract ASCII and UTF-16LE strings from a memory or process dump, then group URLs, IPs, emails, domains, file paths and registry keys locally.
- [Super timeline builder](https://gizza.ai/tools/super-timeline-builder/): Merge parsed forensic artifact CSVs into one sorted UTC timeline with expansion, dedupe, filters, and CSV/l2tcsv/TLN exports.