<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Shellbag Artifacts

## SBECmd (Eric Zimmerman)

```bash
# Parse shellbags from hive directory
SBECmd.exe -d . --csv . --csvf shellbags.csv

# Parse specific hive
SBECmd.exe --hive NTUSER.DAT --csv . --csvf ntuser_bags.csv
SBECmd.exe --hive UsrClass.dat --csv . --csvf usrclass_bags.csv

# Live system
SBECmd.exe -l --csv . --csvf live_bags.csv
```

**CSV columns:** AbsolutePath, ShellType, Value, CreatedOn, ModifiedOn,
AccessedOn, LastWriteTime, MFTEntryNumber, MFTSequenceNumber

## ShellBags Explorer (GUI)

```bash
# Launch GUI — load hive file
ShellBagsExplorer.exe

# Load: File → Load Hive → select NTUSER.DAT or UsrClass.dat
# View: tree view shows folder hierarchy
# Export: File → Save to CSV
```

## python-registry

```python
from Registry import Registry

reg = Registry.Registry("NTUSER.DAT")

# Open BagMRU root
bagmru = reg.open("Software\\Microsoft\\Windows\\Shell\\BagMRU")

# Enumerate folder entries
for value in bagmru.values():
    if value.name().isdigit():
        data = value.value()  # Binary shell item list
        print(f"Entry {value.name()}: {len(data)} bytes")

# Key timestamp = last access
print(f"Last write: {bagmru.timestamp()}")

# Walk subkeys recursively
for subkey in bagmru.subkeys():
    print(f"Subkey: {subkey.name()} (modified: {subkey.timestamp()})")
```

## Registry Paths

### NTUSER.DAT
```
Software\Microsoft\Windows\Shell\BagMRU     — Tree structure
Software\Microsoft\Windows\Shell\Bags       — View preferences
```

### UsrClass.dat (more complete)
```
Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Local Settings\Software\Microsoft\Windows\Shell\Bags
```

## Shell Item Type Bytes

| Byte | Type | Description |
|------|------|-------------|
| `0x1F` | Root | Desktop, My Computer, Control Panel |
| `0x20` | Volume | Fixed/removable volume |
| `0x23` | Drive | Drive letter (C:\) |
| `0x25` | Drive | Full drive path |
| `0x2F` | Volume | Volume GUID |
| `0x31` | Folder | Directory (short name) |
| `0x32` | File | File entry |
| `0x35` | Folder | Directory (Unicode name) |
| `0x41` | Network | Network root |
| `0x42` | Network | UNC path (\\server\share) |
| `0x46` | Network | Domain/workgroup |
| `0x47` | Network | Server |
| `0x61` | URI | FTP location |
| `0xC3` | Network | Network location |

## Shell Item Binary Format (Type 0x31/0x32)

```
Offset  Size  Field
0x00    2     Item size (uint16 LE)
0x02    1     Type byte (0x31 = folder, 0x32 = file)
0x03    1     Unknown
0x04    4     File size (uint32 LE)
0x08    4     Modified date (DOS date/time)
0x0C    2     File attributes
0x0E    N     Short name (8.3, null-terminated ASCII)
...           Extended block with Unicode long name
```

## RegRipper Shellbag Plugin

```bash
rip.pl -r NTUSER.DAT -p shellbags
rip.pl -r UsrClass.dat -p shellbags2
```

## Forensic Interpretation Guide

| Evidence | Shellbag Shows |
|----------|---------------|
| Folder accessed | Entry exists with path and timestamp |
| Network share browsed | UNC path (\\server\share) in entries |
| USB drive explored | Drive letter not C: (e.g., E:\, F:\) |
| ZIP browsed | ZIP path followed by internal folder structure |
| Deleted folder | Shellbag exists but folder no longer on disk |
| Data staging | Sequential folder access pattern → exfiltration |
