Skip to content

Instantly share code, notes, and snippets.

@sf-jonstewart
Last active February 21, 2019 01:35
Show Gist options
  • Save sf-jonstewart/9edb4a9b9b12053eb3c6f50ddd46b3d4 to your computer and use it in GitHub Desktop.
Save sf-jonstewart/9edb4a9b9b12053eb3c6f50ddd46b3d4 to your computer and use it in GitHub Desktop.
Stroz Friedberg developer Shane McCulley rewrote our Python scripts for parsing Windows shell items using Kaitai. We'll contribute the definitions to Kaitai as open source. shell_items.py shows how to construct a parser on top of the Kaitai-generated parsers. This is an unsupported pre-release. Feedback welcome!
import datetime
from typing import AnyStr, Generator, Optional, Tuple, Type, Union
import uuid
from kaitaistruct import BytesIO, KaitaiStream
import known_uuids
import logging
import ShellItemList
logger = logging.getLogger(__name__)
# Parsed item can either be a single ShellItem or a ListItem if in a shell item list
KaitaiShellItem = Union[ShellItemList.ListItem, ShellItemList.ShellItem]
class ShellItem(object):
""" Wraps a KaitaiShellItem for attribute formatting and access """
# Used with unknown UUIDs for context
SORT_INDEX = {
0x00: 'INTERNET_EXPLORER: {}',
0x42: 'LIBRARIES: {}',
0x44: 'USERS: {}',
0x48: 'MY_DOCUMENTS: {}',
0x50: 'MY_COMPUTER: {}',
0x58: 'NETWORK: {}',
0x60: 'RECYCLE_BIN: {}',
0x68: 'INTERNET_EXPLORER: {}',
0x70: 'UNKNOWN: {}',
0x80: 'MY_GAMES: {}'
}
_name_preference_order = ('name', 'ext_block_name', 'short_unicode_name', 'short_ansi_name')
def __init__(self, parsed: KaitaiShellItem, encoding: str) -> None:
self._store_parsed(parsed)
self.encoding = encoding
def __getattr__(self, item: str):
return getattr(self.shell_item.data, item, None)
def _store_parsed(self, parsed: KaitaiShellItem) -> None:
if isinstance(parsed, ShellItemList.ShellItem):
self.shell_item = parsed
self._offset = hex(0)
else:
self.shell_item = parsed.shell_item
self._offset = hex(parsed.offset)
@classmethod
def from_io(cls, io: KaitaiStream, parse_cls: Type[KaitaiShellItem], encoding: str) -> 'ShellItem':
parsed = parse_cls(io, _root=ShellItemList)
return cls(parsed, encoding)
def decode_if_bytes(self, name: AnyStr) -> str:
if isinstance(name, bytes):
return name.decode(self.encoding, errors='backslashreplace')
return name
def convert_dostime(self, prop_name: str) -> Optional[datetime.datetime]:
try:
kaitai_dostime = getattr(self.shell_item.data, prop_name)
except AttributeError:
return None
params = ('year', 'month', 'day', 'hour', 'minute', 'second')
try:
return datetime.datetime(*(getattr(kaitai_dostime, p) for p in params))
except ValueError:
return None
def folder_id(self, uuid_: str) -> str:
index = getattr(self.shell_item.data, 'sort_index', None)
return self.SORT_INDEX.get(index, '{}').format(uuid_)
@property
def modified(self) -> Optional[datetime.datetime]:
return self.convert_dostime('modified')
@property
def accessed(self) -> Optional[datetime.datetime]:
return self.convert_dostime('accessed')
@property
def created(self) -> Optional[datetime.datetime]:
return self.convert_dostime('created')
@property
def offset(self) -> str:
return self._offset
@property
def uuid(self) -> str:
try:
uuid_ = str(uuid.UUID(bytes_le=self.shell_item.data.uuid))
except (AttributeError, TypeError):
uuid_ = '??'
else:
uuid_ = '{' + known_uuids.get(uuid_, self.folder_id(uuid_)) + '}'
return uuid_
@property
def name(self) -> str:
for name_attr in self._name_preference_order:
try:
item_name = getattr(self.shell_item.data, name_attr)
except AttributeError:
continue
else:
if item_name:
return self.decode_if_bytes(item_name)
return self.uuid
def init_kaitai_io(buf: bytes) -> Tuple[KaitaiStream, Type[KaitaiShellItem]]:
""" Creates an io stream and determines Kaitai parsing class """
io = KaitaiStream(BytesIO(buf))
if buf[0] == 0:
parse_cls = ShellItemList.ListItem
io.seek(24) # Skip empty shell item
else:
parse_cls = ShellItemList.ShellItem
return io, parse_cls
def shitems_from_buf(buf: bytes, encoding: str) -> Generator[ShellItem, None, None]:
io, parse_cls = init_kaitai_io(buf)
end_offset = io.size() - 4
while io.pos() < end_offset:
try:
yield ShellItem.from_io(io, parse_cls, encoding)
except EOFError:
logger.warning('Unexpected EOF parsing shellbags')
except Exception as e:
if e.args[0].startswith('unexpected fixed contents'):
expected_actual_msg = e.args[0].partition(': ')[2]
logger.warning('Invalid signature parsing shell item: {}', expected_actual_msg)
meta:
id: dos_datetime
title: Dos Datetime
license: GFDL-1.3-only
endian: le
doc: |
Parses Windows dos datetime, which consists of a 16-bit dosdate and
a 16-bit dostime.
doc-ref: https://docs.microsoft.com/en-us/windows/desktop/api/winbase/nf-winbase-dosdatetimetofiletime
seq:
- id: date
-orig-id: wFatTime
type: u2
- id: time
-orig-id: lpFileTime
type: u2
instances:
year:
value: (date >> 9) + 1980
month:
value: (date & 0b0000000111100000) >> 5
day:
value: (date & 0b0000000000011111)
hour:
value: time >> 11
minute:
value: (time & 0b0000011111100000) >> 5
second:
value: (time & 0b0000000000011111) * 2
doc: 2-second granularity
meta:
id: shell_item_list
title: Windows Shell Item List
license: GFDL-1.3-only
imports:
- dos_datetime
- terminated_utf16le
endian: le
doc: |
The Windows Shell uses Shell Items (Shell item list) to identify items
within the Windows Folder Hierarchy. A Shell Item list is much like a path,
and is unique to its parent folder. The format of the Shell Item is
undocumented and varies between Windows versions. This specification is
based on Windows Shell Item format specification by Joachim Metz.
doc-ref: https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc
seq:
- id: empty_item
size: 24
if: is_list
- id: items
type:
switch-on: is_list
cases:
true: list_item
false: shell_item
repeat: until
repeat-until: _io.pos >= end_offset
instances:
first_byte:
pos: 0
size: 1
is_list:
value: first_byte == [0]
end_offset:
value: _io.size - 4
types:
list_item:
doc: Shell items come in either a list form or as single shell_items
seq:
- id: shell_item
size: 'item_size > 0 ? item_size : 0x10'
type: shell_item
doc: An empty shell item has 0x10 bytes of zeros.
- id: footer_signature
size: 4
- id: unknown
size: 4
instances:
offset: # saved for later access
value: _io.pos
item_size:
pos: offset
type: u2
shell_item:
doc: |
Varying shell item formats are used in the Windows Folder Hierarchy. Data
types parse known structures and have unknown/padding until end of stream.
doc-ref: https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc
seq:
- id: data_size
type: u2
- id: class_type
type: u1
doc: |
Class type is a combination of a type, subtype, and flags. It has not
proven to be foolproof for all shell items, but appears to be a
strong one for others.
- id: data
size: data_size - 3
type:
switch-on: switch_value.value
cases:
0x00: unknown_00
0x02: unknown_02
0x1F: root_folder_data
0x20: volume_name_data(class_type)
0x30: file_entry_data(class_type)
0x40: network_location_data(class_type)
0x61: uri_data
0x70: control_panel_data_70
0x71: control_panel_data_71
0x74: delegate_item_data
if: data_size > 3
instances:
mask_type:
value: class_type & 0x70
switch_value:
type:
switch-on: mask_type
cases:
0x20: intval(mask_type)
0x30: intval(mask_type)
0x40: intval(mask_type)
_: intval(class_type)
doc: |
Types with flag values (volume, file entry, network location)
switch on masked type due to the range of possible values.
types:
intval:
doc: Workaround for inability to use switch in value statements.
params:
- id: value
type: u1
unknown_00:
doc: |
Class type 0x0. A number of signature-based types have a 0x0 type
with varying formats. If this type has a large size (unknown, but
typically > 50 seen) it almost always contains a Microsoft
serialized property store object.
instances:
uuid:
pos: 0xB
size: 16
if: _parent.data_size == 0x20
unknown_02:
doc: Class type 0x2
seq:
- id: flags
type: u1
- id: uuid
size: 16
root_folder_data:
doc: Class type 0x1F
seq:
- id: sort_index
type: u1
- id: uuid
size: 16
volume_name_data:
doc: Class type & 0x70 == 0x20
params:
- id: class_type
type: u1
seq:
- id: name
terminator: 0
if: has_name
instances:
has_name:
value: class_type & 0x01 != 0
is_removable_media:
value: class_type & 0x08 != 0
uuid:
pos: 1
size: 16
if: not has_name
file_entry_data:
doc: Class type & 0x70 == 0x30
params:
- id: class_type
type: u1
seq:
- id: empty
size: 1
- id: filesize
type: u4
- id: modified
type: dos_datetime
- id: fileattrs
type: u2
- id: short_unicode_name
type: terminated_utf16le(0)
if: has_unicode_name
- id: short_ansi_name
terminator: 0
if: not has_unicode_name
- id: zero_padding
size: padding_size
- id: ext_block_size
type: u2
- id: ext_block
type: extension_block
size: ext_block_size - 2
if: has_ext_block
instances:
is_dir:
value: class_type & 0x01 != 0
is_file:
value: class_type & 0x02 != 0
has_unicode_name:
value: class_type & 0x04 != 0
has_ext_block:
value: ext_block_size > 0
ext_offset:
pos: _io.size - 2
type: u2
padding_size:
value: 'ext_offset > 0 ? ext_offset - _io.pos - 3 : 0'
created:
value: ext_block.created
if: has_ext_block
accessed:
value: ext_block.accessed
if: has_ext_block
ext_block_name:
value: ext_block.name
if: has_ext_block
network_location_data:
doc: Class type & 0x70 == 0x40
params:
- id: class_type
type: u1
seq:
- id: uuid
size: 16
if: class_type & 0x0F == 0x0D or class_type & 0x0F == 0x0E
- id: unknown
size: 1
- id: flags
type: u1
- id: name
-orig-id: location
terminator: 0
- id: description
terminator: 0
if: flags & 0x80 != 0
- id: comments
terminator: 0
if: flags & 0x40 != 0
uri_data:
doc: Class type 0x61
seq:
- id: flags
type: u4
instances:
uri_block:
pos: 0x8
type: terminated_utf16le(0)
name:
value: uri_block.as_string
control_panel_data_70:
doc: Class type 0x70
seq:
- id: unknown
size: 1
- id: uuid
size: 16
if: _io.size >= 17
control_panel_data_71:
doc: Class type 0x71
seq:
- id: flags
type: u1
instances:
uuid:
pos: 0xB
size: 16
delegate_item_data:
doc: Class type 0x74
seq:
- id: unknown
size: 3
- id: signature
contents: [0x43, 0x46, 0x53, 0x46]
- id: file_frag_size
type: u2
- id: file_frag_type
type: u1
- id: file_frag
size: file_frag_size - 1
type: file_entry_data(file_frag_type)
- id: delegate_item_uuid
size: 16
- id: item_class_uuid
size: 16
- id: ext_block_size
type: u2
- id: ext_block
size: ext_block_size - 2
type: extension_block
if: has_ext_block
instances:
has_ext_block:
value: ext_block_size > 0
ext_block_name:
value: ext_block.name
if: has_ext_block
short_unicode_name:
value: file_frag.short_unicode_name
if: file_frag.has_unicode_name
short_ansi_name:
value: file_frag.short_ansi_name
if: not file_frag.has_unicode_name
accessed:
value: ext_block.accessed
if: has_ext_block
created:
value: ext_block.created
if: has_ext_block
modified:
value: file_frag.modified
extension_block:
doc: Implementation of extension block types.
doc-ref: https://github.com/libyal/libfwsi/blob/master/documentation/Windows%20Shell%20Item%20format.asciidoc#extension_block_0xbeef0000
seq:
- id: version
type: u2
- id: signature
type: u4
- id: data
type:
switch-on: signature
cases:
0xBEEF0004: beef0004
instances:
name:
value: data.name
created:
value: data.created
accessed:
value: data.accessed
types:
file_ref:
seq:
- id: mft_recordnum
size: 6
- id: sequence_number
type: u2
beef0004:
seq:
- id: created
type: dos_datetime
- id: accessed
type: dos_datetime
- id: identifier
type: u2
- id: empty
size: 2
if: version >= 0x0007
- id: mft_ref
type: file_ref
if: version >= 0x0007
- id: unknown
size: 8
if: version >= 0x0007
- id: localized_name_size
type: u2
if: version >= 0x0003
- id: empty2
size: 4
if: version >= 0x0009
- id: unknown2
size: 4
if: version >= 0x0008
- id: long_name_block
type: terminated_utf16le(0)
- id: localized_name_block
type: terminated_utf16le(0)
if: has_localized_name
- id: ext_block_offset
type: u2
instances:
has_localized_name:
value: version >= 0x0003 and localized_name_size > 0
version:
value: _parent.version
name:
value: long_name_block.as_string
localized_name:
value: localized_name_block.as_string
if: has_localized_name
meta:
id: terminated_utf16le
title: Terminated UTF-16le String
license: GFDL-1.3-only
endian: le
doc: Modified hack from windows_resource_file.ksy to read utf-16le string.
doc-ref: https://github.com/kaitai-io/kaitai_struct_formats/blob/master/windows/windows_resource_file.ksy
params:
- id: terminator_value
type: u2
seq:
- id: save_start_noop
size: 0
if: save_start >= 0 # Accessing save_start saves starting offset
- id: rest
type: u2
repeat: until
repeat-until: _ == terminator_value
- id: save_end_noop
size: 0
if: save_end >= 0 # Accessing save_end sets ending offset
instances:
# Super dirty hack saves start/end positions to re-read it as string
save_start:
value: _io.pos
save_end:
value: _io.pos
len_str:
value: 'save_end - save_start - 2'
as_string:
pos: save_start
size: len_str
type: str
encoding: utf-16le
if: len_str > 0
known_uuids = {
"008ca0b1-55b4-4c56-b8a8-4de4b299d3be": "Account Pictures",
"00bcfc5a-ed94-4e48-96a1-3f6217f21990": "RoamingTiles",
"00c6d95f-329c-409a-81d7-c46c66ea7f33": "Default Location",
"00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3": "Scanners and Cameras",
"0139d44e-6afe-49f2-8690-3dafcae6ffb8": "Start Menu Programs",
"0142e4d0-fb7a-11dc-ba4a-000ffe7ab428": "Biometric Devices",
"018d5c66-4533-4307-9b53-224de2ed1fe6": "OneDrive",
"025a5937-a6be-4686-a844-36fe4bec8b6d": "Power Options",
"031e4825-7b94-4dc3-b131-e946b44c8dd5": "Libraries",
"04731b67-d933-450a-90e6-4acd2e9408fe": "Search Folder",
"0482af6c-08f1-4c34-8c90-e17ec98b1e17": "Public Account Pictures",
"054fae61-4dd8-4787-80b6-090220c4b700": "GameExplorer",
"05d7b0f4-2121-4eff-bf6b-ed3f69b894d9": "Taskbar (NotificationAreaIcons)",
"0762d272-c50a-4bb0-a382-697dcd729b80": "Users",
"087da31b-0dd3-4537-8e23-64a18591f88b": "Windows Security Center",
"088e3905-0323-4b02-9826-5d99428e115f": "Downloads",
"0907616e-f5e6-48d8-9d61-a91c3d28106d": "Hyper-V Remote File Browsing",
"0ac0837c-bbf8-452a-850d-79d08e667ca7": "Computer",
"0afaced1-e828-11d1-9187-b532f1e9575d": "Folder Shortcut",
"0b2baaeb-0042-4dca-aa4d-3ee8648d03e5": "Pictures Library",
"0c15d503-d017-47ce-9016-7b3f978721cc": "Portable Device Values",
"0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd": "Recent Items",
"0cd7a5c0-9f37-11ce-ae65-08002b2e1262": "Cabinet File",
"0d4c3db6-03a3-462f-a0e6-08924c41b5d4": "History",
"0df44eaa-ff21-4412-828e-260a8728e7f1": "Taskbar and Start Menu",
"0f214138-b1d3-4a90-bba9-27cbc0c5389a": "Sync Setup",
"11016101-e366-4d22-bc06-4ada335c892b": "Internet Explorer History and Feeds Shell Data Source for Windows Search",
"1206f5f1-0569-412c-8fec-3204630dfb70": "Credential Manager",
"13e7f612-f261-4391-bea2-39df4f3fa311": "Windows Desktop Search",
"15ca69b3-30ee-49c1-ace1-6b5ec372afb5": "Sample Playlists",
"15eae92e-f17a-4431-9f28-805e482dafd4": "Install New Programs ",
"1723d66a-7a12-443e-88c7-05e1bfe79983": "Previous Versions Delegate Folder",
"1777f761-68ad-4d8a-87bd-30b759fa33dd": "Favorites",
"17cd9488-1228-4b2f-88ce-4298e93e0966": "Default Programs",
"18989b1d-99b5-455b-841c-ab7c74e4ddfc": "Videos",
"190337d1-b8ca-4121-a639-6d472d16972a": "Search Results",
"1a6fdba2-f42d-4358-a798-b74d745926c5": "Recorded TV",
"1a9ba3a0-143a-11cf-8350-444553540000": "Shell Favorite Folder",
"1ac14e77-02e7-4e5d-b744-2eb1ae5198b7": "System32",
"1b3ea5dc-b587-4786-b4ef-bd1dc332aeae": "Libraries",
"1cf1260c-4dd0-4ebb-811f-33c572699fde": "Music",
"1d2680c9-0e2a-469d-b787-065558bc7d43": "Fusion Cache",
"1e87508d-89c2-42f0-8a7e-645a0f50ca58": "Applications",
"1f3427c8-5c10-4210-aa03-2ee45287d668": "User Pinned",
"1f43a58c-ea28-43e6-9ec4-34574a16ebb7": "Windows Desktop Search MAPI Namespace Extension Class",
"1f4de370-d627-11d1-ba4f-00a0c91eedba": "Search Results - Computers (Computer Search Results Folder, Network Computers)",
"1fa9085f-25a2-489b-85d4-86326eedcd87": "Manage Wireless Networks",
"208d2c60-3aea-1069-a2d7-08002b30309d": "My Network Places",
"20d04fe0-3aea-1069-a2d8-08002b30309d": "My Computer",
"2112ab0a-c86a-4ffe-a368-0de96e47012e": "Music",
"21ec2020-3aea-1069-a2dd-08002b30309d": "Control Panel",
"2227a280-3aea-1069-a2de-08002b30309d": "Printers",
"22877a6d-37a1-461a-91b0-dbda5aaebc99": "Recent Places",
"2400183a-6185-49fb-a2d8-4a392a602ba3": "Public Videos",
"241d7c96-f8bf-4f85-b01f-e2b043341a4b": "Workspaces Center(Remote Application and Desktop Connections)",
"24ad3ad4-a569-4530-98e1-ab02f9417aa8": "Pictures",
"24d89e24-2f19-4534-9dde-6a6671fbb8fe": "Documents",
"2559a1f0-21d7-11d4-bdaf-00c04f60b9f0": "Search",
"2559a1f1-21d7-11d4-bdaf-00c04f60b9f0": "Help and Support",
"2559a1f2-21d7-11d4-bdaf-00c04f60b9f0": "Windows Security",
"2559a1f3-21d7-11d4-bdaf-00c04f60b9f0": "Run...",
"2559a1f4-21d7-11d4-bdaf-00c04f60b9f0": "Internet",
"2559a1f5-21d7-11d4-bdaf-00c04f60b9f0": "E-mail",
"2559a1f6-21d7-11d4-bdaf-00c04f60b9f0": "OEM link",
"2559a1f7-21d7-11d4-bdaf-00c04f60b9f0": "Set Program Access and Defaults",
"259ef4b1-e6c9-4176-b574-481532c9bce8": "Game Controllers",
"267cf8a9-f4e3-41e6-95b1-af881be130ff": "Location Folder",
"26ee0668-a00a-44d7-9371-beb064c98683": "Control Panel",
"2728520d-1ec8-4c68-a551-316b684c4ea7": "Network Setup Wizard",
"27e2e392-a111-48e0-ab0c-e17705a05f85": "WPD Content Type Folder",
"28803f59-3a75-4058-995f-4ee5503b023c": "Bluetooth Devices",
"289978ac-a101-4341-a817-21eba7fd046d": "Sync Center Conflict Folder",
"289a9a43-be44-4057-a41b-587a76d7e7f9": "Sync Results",
"289af617-1cc3-42a6-926c-e6a863f0e3ba": "DLNA Media Servers Data Source",
"292108be-88ab-4f33-9a26-7748e62e37ad": "Videos library",
"2965e715-eb66-4719-b53f-1672673bbefa": "Results Folder",
"2a00375e-224c-49de-b8d1-440df7ef3ddc": "LocalizedResourcesDir",
"2b0f765d-c0e9-4171-908e-08a611b84ff6": "Cookies",
"2c36c0aa-5812-4b87-bfd0-4cd0dfb19b39": "Original Images",
"2e9e59c0-b437-4981-a647-9c34b9b90891": "Sync Setup Folder",
"2f6ce85c-f9ee-43ca-90c7-8a9bd53a2467": "File History Data Source",
"3080f90d-d7ad-11d9-bd98-0000947b0257": "Show Desktop",
"3080f90e-d7ad-11d9-bd98-0000947b0257": "Window Switcher",
"3214fab5-9757-4298-bb61-92a9deaa44ff": "Public Music",
"323ca680-c24d-4099-b94d-446dd2d7249e": "Common Places",
"328b0346-7eaf-4bbe-a479-7cb88a095f5b": "Layout Folder",
"335a31dd-f04b-4d76-a925-d6b47cf360df": "Backup and Restore Center",
"339719b5-8c47-4894-94c2-d8f77add44a6": "Pictures",
"33e28130-4e1e-4676-835a-98395c3bc3bb": "Pictures",
"352481e8-33be-4251-ba85-6007caedcf9d": "Temporary Internet Files",
"35786d3c-b075-49b9-88dd-029876e11c01": "Portable Devices",
"36011842-dccc-40fe-aa3d-6177ea401788": "Documents Search Results",
"36eef7db-88ad-4e81-ad49-0e313f0c35f8": "Windows Update",
"374de290-123f-4565-9164-39c4925e467b": "Downloads",
"37efd44d-ef8d-41b1-940d-96973a50e9e0": "Desktop Gadgets",
"38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b": "Connect To",
"3add1653-eb32-4cb0-bbd7-dfa0abb5acca": "Pictures",
"3c5c43a3-9ce9-4a9b-9699-2ac0cf6cc4bf": "Configure Wireless Network",
"3d644c9b-1fb8-4f30-9b45-f670235f79c0": "Public Downloads",
"3dfdf296-dbec-4fb4-81d1-6a3438bcf4de": "Music",
"3e7efb4c-faf1-453d-89eb-56026875ef90": "Windows Marketplace",
"3eb685db-65f9-4cf6-a03a-e3ef65729f3d": "RoamingAppData",
"3f2a72a7-99fa-4ddb-a5a8-c604edf61d6b": "Music Library",
"3f6bc534-dfa1-4ab4-ae54-ef25a74e0107": "System Restore",
"3f98a740-839c-4af7-8c36-5badfb33d5fd": "Documents library",
"4026492f-2f69-46b8-b9bf-5654fc07e423": "Windows Firewall",
"40419485-c444-4567-851a-2dd7bfa1684d": "Phone and Modem",
"418c8b64-5463-461d-88e0-75e2afa3c6fa": "Explorer Browser Results Folder",
"4234d49b-0245-4df3-b780-3893943456e1": "Applications",
"4336a54d-038b-4685-ab02-99bb52d3fb8b": "Samples",
"43668bf8-c14e-49b2-97c9-747784d784b7": "Sync Center",
"437ff9c0-a07f-4fa0-af80-84b6c6440a16": "Command Folder",
"450d8fba-ad25-11d0-98a8-0800361b1103": "My Documents",
"4564b25e-30cd-4787-82ba-39e73a750b14": "Recent Items Instance Folder",
"45c6afa5-2c13-402f-bc5d-45cc8172ef6b": "Toshiba Bluetooth Stack",
"46137b78-0ec3-426d-8b89-ff7c3a458b5e": "Network Neighborhood",
"46e06680-4bf0-11d1-83ee-00a0c90dc849": "NETWORK_DOMAIN",
"48daf80b-e6cf-4f4e-b800-0e69d84ee384": "Libraries",
"48e7caab-b918-4e58-a94d-505519c795dc": "Start Menu Folder",
"491e922f-5643-4af4-a7eb-4e7a138d8174": "Videos",
"4bd8d571-6d19-48d3-be97-422220080e43": "Music",
"4bfefb45-347d-4006-a5be-ac0cb0567192": "Conflicts",
"4c5c32ff-bb9d-43b0-b5b4-2d72e54eaaa4": "Saved Games",
"4d9f7874-4e0c-4904-967b-40b0d20c3e4b": "Internet",
"4dcafe13-e6a7-4c28-be02-ca8c2126280d": "Pictures Search Results",
"52205fd8-5dfb-447d-801a-d0b52f2e83e1": "Windows Explorer",
"5224f545-a443-4859-ba23-7b5a95bdc8ef": "People Near Me",
"52528a6b-b9e3-4add-b60d-588c2dba842d": "Homegroup",
"52a4f021-7b75-48a9-9f6b-4b87a210bc8f": "Quick Launch",
"5399e694-6ce5-4d6c-8fce-1d8870fdcba0": "Control Panel command object for Start menu and desktop",
"54a754c0-4bf1-11d1-83ee-00a0c90dc849": "NETWORK_SHARE",
"56784854-c6cb-462b-8169-88e350acb882": "Contacts",
"58e3c745-d971-4081-9034-86e34b30836a": "Speech Recognition Options",
"59031a47-3f72-44a7-89c5-5595fe6b30ee": "Shared Documents Folder (Users Files)",
"5b3749ad-b49f-49c1-83eb-15370fbd4882": "TreeProperties",
"5b934b42-522b-4c34-bbfe-37a3ef7b9c90": "This Device Folder",
"5c4f28b5-f869-4e84-8e60-f11db97c5cc7": "Generic (All folder items)",
"5cd7aee2-2219-4a67-b85d-6c9ce15660cb": "Programs",
"5ce4a5e9-e4eb-479d-b89f-130c02886155": "DeviceMetadataStore",
"5e6c858f-0e22-4760-9afe-ea3317b67173": "Profile",
"5e8fc967-829a-475c-93ea-51fce6d9ffce": "RealPlayer Cloud",
"5ea4f148-308c-46d7-98a9-49041b1dd468": "Mobility Center Control Panel",
"5f4eab9a-6833-4f61-899d-31cf46979d49": "Generic library",
"5fa947b5-650a-4374-8a9a-5efa4f126834": "OpenDrive",
"5fa96407-7e77-483c-ac93-691d05850de8": "Videos",
"5fcd4425-ca3a-48f4-a57c-b8a75c32acb1": "Hewlett-Packard Recovery (Protect.dll)",
"60632754-c523-4b62-b45c-4172da012619": "User Accounts",
"625b53c3-ab48-4ec1-ba1f-a1ef4146fc19": "Start Menu",
"62ab5d82-fdc1-4dc3-a9dd-070d1d495d97": "ProgramData",
"62d8ed13-c9d0-4ce8-a914-47dd628fb1b0": "Regional and Language Options",
"631958a6-ad0f-4035-a745-28ac066dc6ed": "Videos Library",
"6365d5a7-0f0d-45e5-87f6-0da56b6a4f7d": "Common Files x64",
"63da6ec0-2e98-11cf-8d82-444553540000": "Microsoft FTP Folder",
"640167b4-59b0-47a6-b335-a6b3c0695aea": "Portable Media Devices",
"645ff040-5081-101b-9f08-00aa002f954e": "Recycle bin",
"64693913-1c21-4f30-a98f-4e52906d3b56": "App Instance Folder",
"67718415-c450-4f3c-bf8a-b487642dc39b": "Windows Features",
"6785bfac-9d2d-4be5-b7e2-59937e8fb80a": "Other Users Folder",
"679f85cb-0220-4080-b29b-5540cc05aab6": "Home Folder",
"67ca7650-96e6-4fdd-bb43-a8e774f73a57": "Home Group Control Panel (Home Group)",
"692f0339-cbaa-47e6-b5b5-3b84db604e87": "Extensions Manager Folder",
"69d2cf90-fc33-4fb7-9a0c-ebb0f0fcb43c": "Slide Shows",
"6c8eec18-8d75-41b2-a177-8831d59d2d50": "Mouse",
"6d809377-6af0-444b-8957-a3773f02200e": "Program Files x64",
"6dfd7c5c-2451-11d3-a299-00c04f8ef6af": "Folder Options",
"6f0cd92b-2e97-45d1-88ff-b0d186b8dedd": "Network Connections",
"7007acc7-3202-11d1-aad2-00805fc1270e": "Network Connections",
"708e1662-b832-42a8-bbe1-0a77121e3908": "Tree property value folder",
"71689ac1-cc88-45d0-8a22-2943c3e7dfb3": "Music Search Results",
"71d99464-3b6b-475c-b241-e15883207529": "Sync Results Folder",
"724ef170-a42d-4fef-9f26-b60e846fba4f": "Administrative tools",
"725be8f7-668e-4c7b-8f90-46bdb0936430": "Keyboard",
"72b36e70-8700-42d6-a7f7-c9ab3323ee51": "Search Connector Folder",
"74246bfc-4c96-11d0-abef-0020af6b0b7a": "Device Manager",
"767e6811-49cb-4273-87c2-20f355e1085b": "Camera Roll",
"76fc4e2d-d6ad-4519-a663-37bd56068185": "Printers",
"78cb147a-98ea-4aa6-b0df-c8681f69341c": "Windows CardSpace",
"78f3955e-3b90-4184-bd14-5397c15f1efc": "Performance Information and Tools",
"7a979262-40ce-46ff-aeee-7884ac3b6136": "Add Hardware",
"7a9d77bd-5403-11d2-8785-2e0420524153": "User Accounts (Users and Passwords)",
"7b0db17d-9cd2-4a93-9733-46cc89022e7c": "Documents",
"7b396e54-9ec5-4300-be0a-2482ebae1a26": "Gadgets",
"7b81be6a-ce2b-4676-a29e-eb907a5126c5": "Programs and Features",
"7bd29e00-76c1-11cf-9dd0-00a0c9034933": "Temporary Internet Files",
"7bd29e01-76c1-11cf-9dd0-00a0c9034933": "Temporary Internet Files",
"7be9d83c-a729-4d97-b5a7-1b7313c39e0a": "Programs Folder",
"7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e": "Program Files x86",
"7d1d3a04-debb-4115-95cf-2f29da2920da": "Searches",
"7d49d726-3c21-4f05-99aa-fdc2c9474656": "Documents",
"7e636bfe-dfa9-4d5e-b456-d7b39851d8a9": "Templates",
"7fde1a1e-8b31-49a5-93b8-6be14cfa4943": "Generic Search Results",
"80213e82-bcfd-4c4f-8817-bb27601267a9": "Compressed Folder (zip folder)",
"8060b2e3-c9d7-4a5d-8c6b-ce8eba111328": "Proximity CPL",
"80f3f1d5-feca-45f3-bc32-752c152e456e": "Tablet PC Settings",
"82a5ea35-d9cd-47c5-9629-e15d2f714e6e": "CommonStartup",
"82a74aeb-aeb4-465c-a014-d097ee346d63": "Control Panel",
"82ba0782-5b7a-4569-b5d7-ec83085f08cc": "TopViews",
"8343457c-8703-410f-ba8b-8b026e431743": "Feedback Tool",
"859ead94-2e85-48ad-a71a-0969cb56a6cd": "Sample Videos",
"85bbd920-42a0-1069-a2e4-08002b30309d": "Briefcase",
"863aa9fd-42df-457b-8e4d-0de1b8015c60": "Remote Printers",
"865e5e76-ad83-4dca-a109-50dc2113ce9a": "Programs Folder and Fast Items",
"871c5380-42a0-1069-a2ea-08002b30309d": "Internet Explorer (Homepage)",
"87630419-6216-4ff8-a1f0-143562d16d5c": "Mobile Broadband Profile Settings Editor",
"877ca5ac-cb41-4842-9c69-9136e42d47e2": "File Backup Index",
"87d66a43-7b11-4a28-9811-c86ee395acf7": "Indexing Options",
"88c6c381-2e85-11d0-94de-444553540000": "ActiveX Cache Folder",
"896664f7-12e1-490f-8782-c0835afd98fc": "Libraries delegate folder that appears in Users Files Folder",
"8983036c-27c0-404b-8f08-102d10dcfd74": "SendTo",
"89d83576-6bd1-4c86-9454-beb04e94c819": "MAPI Folder",
"8abd94fb-e7d6-84a6-a997-c918edde0ae5": "Computer Management",
"8ad10c31-2adb-4296-a8f7-e4701232c972": "Resources",
"8e74d236-7f35-4720-b138-1fed0b85ea75": "OneDrive",
"8e908fc9-becc-40f6-915b-f4ca0e70d03d": "Network and Sharing Center",
"8fd8b88d-30e1-4f25-ac2b-553d3d65f0ea": "DXP",
"905e63b6-c1bf-494e-b29c-65b732d3d21a": "Program Files",
"9113a02d-00a3-46b9-bc5f-9c04daddd5d7": "Enhanced Storage Data Source",
"9274bd8d-cfd1-41c3-b35e-b13f55a758f4": "Printer Shortcuts",
"93412589-74d4-4e4e-ad0e-e0cb621440fd": "Font Settings",
"9343812e-1c37-4a49-a12e-4b2d810d956b": "Search Home",
"94d6ddcc-4a68-4175-a374-bd584a510b78": "Music",
"96437431-5a90-4658-a77c-25478734f03e": "Server Manager",
"96ae8d84-a250-4520-95a5-a47a7e3c548b": "Parental Controls",
"978e0ed7-92d6-4cec-9b59-3135b9c49ccf": "Music library",
"98d99750-0b8a-4c59-9151-589053683d73": "Windows Search Service Media Center Namespace Extension Handler",
"98ec0e18-2098-4d44-8644-66979315a281": "Microsoft Office Outlook",
"98f275b4-4fff-11e0-89e2-7b86dfd72085": "Start Menu Launcher Provider Folder",
"992cffa0-f557-101a-88ec-00dd010ccc48": "Network Connections",
"9a096bb5-9dc3-4d1c-8526-c3cbf991ea4e": "Internet Explorer RSS Feeds Folder",
"9b74b6a3-0dfd-4f11-9e78-5f7800f2e772": "The user's username (%USERNAME%)",
"9c60de1e-e5fc-40f4-a487-460851a8d915": "AutoPlay",
"9c73f5e5-7ae7-4e32-a8e8-8d23b85255bf": "Sync Center",
"9db7a13c-f208-4981-8353-73cc61ae2783": "Previous Versions",
"9e3995ab-1f9c-4f13-b827-48b24b6c7174": "User Pinned",
"9e52ab10-f80d-49df-acb8-4330f5687855": "CDBurning",
"9f433b7c-5f96-4ce1-ac28-aeaa1cc04d7c": "Security Center",
"9fe63afd-59cf-4419-9775-abcc3849f861": "System Recovery",
"a00ee528-ebd9-48b8-944a-8942113d46ac": "Start Menu Commanding Provider Folder",
"a0275511-0e86-4eca-97c2-ecd8f1221d08": "Infrared",
"a0953c92-50dc-43bf-be83-3742fed03c9c": "Videos",
"a302545d-deff-464b-abe8-61c8648d939b": "Libraries",
"a304259d-52b8-4526-8b1a-a1d6cecc8243": "iSCSI Initiator",
"a305ce99-f527-492b-8b1a-7e76fa98d6e4": "Installed Updates",
"a3918781-e5f2-4890-b3d9-a7e54332328c": "Application Shortcuts",
"a3c3d402-e56c-4033-95f7-4885e80b0111": "Previous Versions Results Delegate Folder",
"a3dd4f92-658a-410f-84fd-6fbbbef2fffe": "Internet Options",
"a4115719-d62e-491d-aa7c-e74b8be3b067": "Start Menu",
"a5110426-177d-4e08-ab3f-785f10b4439c": "Sony Ericsson File Manager",
"a520a1a4-1780-4ff6-bd18-167343c5af16": "AppDataLow",
"a52bba46-e9e1-435f-b3d9-28daa648c0f6": "OneDrive",
"a5a3563a-5755-4a6f-854e-afa3230b199f": "Library Folder",
"a5e46e3a-8849-11d1-9d8c-00c04fc99d61": "Microsoft Browser Architecture",
"a63293e8-664e-48db-a079-df759e0509f7": "Templates",
"a6482830-08eb-41e2-84c1-73920c2badb9": "Removable Storage Devices",
"a75d362e-50fc-4fb7-ac2c-a8beaa314493": "SidebarParts",
"a77f5d77-2e2b-44c3-a6a2-aba601054a51": "Programs",
"a8a91a66-3a7d-4424-8d24-04e180695c7a": "Device Center(Devices and Printers)",
"a8cdff1c-4878-43be-b5fd-f8091c1c60d0": "Documents",
"a990ae9f-a03b-4e80-94bc-9912d7504104": "Pictures",
"aaa8d5a5-f1d6-4259-baa8-78e7ef60835e": "RoamedTileImages",
"ab4f43ca-adcd-4384-b9af-3cecea7d6544": "Sitios Web",
"ab5fb87b-7ce2-4f83-915d-550846c9537b": "Camera Roll",
"ae50c081-ebd2-438a-8655-8a092e34987a": "Recent Items",
"aee2420f-d50e-405c-8784-363c582bf45a": "Device Pairing Folder",
"afdb1f70-2a4c-11d2-9039-00c04f8eeb3e": "Offline Files Folder",
"b155bdf8-02f0-451e-9a26-ae317cfd7779": "Delegate folder that appears in Computer",
"b250c668-f57d-4ee1-a63c-290ee7d1aa1f": "Sample Music",
"b28aa736-876b-46da-b3a8-84c5e30ba492": "Web sites",
"b2952b16-0e07-4e5a-b993-58c52cb94cae": "DB Folder",
"b2c761c6-29bc-4f19-9251-e6195265baf1": "Color Management",
"b3690e58-e961-423b-b687-386ebfd83239": "Pictures folder",
"b4bfcc3a-db2c-424c-b029-7fe99a87c641": "Desktop",
"b4fb3f98-c1ea-428d-a78a-d1f5659cba93": "Other Users Folder",
"b5947d7f-b489-4fde-9e77-23780cc610d1": "Virtual Machines",
"b689b0d0-76d3-4cbb-87f7-585d0e0ce070": "Games folder",
"b6ebfb86-6907-413c-9af7-4fc2abf07cc5": "Public Pictures",
"b7534046-3ecb-4c18-be4e-64cd4cb7d6ac": "Recycle Bin",
"b7bede81-df94-4682-a7d8-57a52620b86f": "Screenshots",
"b94237e7-57ac-4347-9151-b08c6c32d1f7": "CommonTemplates",
"b97d20bb-f46a-4c97-ba10-5e3608430854": "Startup",
"b98a2bea-7d42-4558-8bd1-832f41bac6fd": "Backup And Restore (Backup and Restore Center)",
"bb06c0e4-d293-4f75-8a90-cb05b6477eee": "System",
"bb64f8a7-bee7-4e1a-ab8d-7d8273f7fdb6": "Action Center/Security and Maintenance (Win10)",
"bc476f4c-d9d7-4100-8d4e-e043f6dec409": "Microsoft Browser Architecture",
"bc48b32f-5910-47f5-8570-5074a8a5636a": "Sync Results Delegate Folder",
"bcb5256f-79f6-4cee-b725-dc34e402fd46": "ImplicitAppShortcuts",
"bcbd3057-ca5c-4622-b42d-bc56db0ae516": "Programs",
"bd7a2e7b-21cb-41b2-a086-b309680c6b7e": "Client Side Cache Folder",
"bd84b380-8ca2-1069-ab1d-08000948f534": "Microsoft Windows Font Folder",
"bd85e001-112e-431e-983b-7b15ac09fff1": "RecordedTV",
"bdbe736f-34f5-4829-abe8-b550e65146c4": "TopViews",
"bdeadf00-c265-11d0-bced-00a0c90ab50f": "Web Folders",
"be122a0e-4503-11da-8bde-f66bad1e3f3a": "Windows Anytime Upgrade",
"bf782cc9-5a52-4a17-806c-2a894ffeeac5": "Language Settings",
"bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968": "Links",
"c0542a90-4bf0-11d1-83ee-00a0c90dc849": "NETWORK_SERVER",
"c16a18a2-dc4f-4b7d-92f1-14c430ad17dc": "Task Scheduler",
"c1bae2d0-10df-4334-bedd-7aa20b227a9d": "Common OEM Links",
"c1f8339f-f312-4c97-b1c6-ecdf5910c5c0": "Pictures library",
"c291a080-b400-4e34-ae3f-3d2b9637d56c": "UNCFAT IShellFolder Class",
"c2b136e2-d50e-405c-8784-363c582bf43e": "Device Center Initialization",
"c4900540-2379-4c75-844b-64e6faf8716b": "Sample Pictures",
"c4aa340d-f20f-4863-afef-f87ef2e6ba25": "Public Desktop",
"c4d98f09-6124-4fe0-9942-826416082da9": "Users libraries",
"c555438b-3c23-4769-a71f-b6d3d9b6053a": "Display",
"c57a6066-66a3-4d91-9eb9-41532179f0a5": "Application Suggested Locations",
"c58c4893-3be0-4b45-abb5-a63e4b8c8651": "Troubleshooting",
"c5abbf53-e17f-4121-8900-86626fc2c973": "Network Shortcuts",
"c870044b-f49e-4126-a9c3-b52a1ff411e8": "Ringtones",
"cac52c1a-b53d-4edc-92d7-6b2e8ac19434": "Games",
"cb1b7f8c-c50a-4176-b604-9e24dee8d4d1": "Welcome Center",
"cce6191f-13b2-44fa-8d14-324728beef2c": "{Unknown CSIDL}",
"d0384e7d-bac3-4797-8f14-cba229b392b5": "Administrative Tools",
"d17d1d6d-cc3f-4815-8fe3-607e7d5d10b3": "Text to Speech",
"d2035edf-75cb-4ef1-95a7-410d9ee17170": "DLNA Content Directory Data Source",
"d20beec4-5ca8-4905-ae3b-bf251ea09b53": "Network",
"d20ea4e1-3957-11d2-a40b-0c5020524152": "Fonts",
"d20ea4e1-3957-11d2-a40b-0c5020524153": "Administrative Tools",
"d24f75aa-4f2b-4d07-a3c4-469b3d9030c4": "Offline Files",
"d3162b92-9365-467a-956b-92703aca08af": "Documents",
"d34a6ca6-62c2-4c34-8a7c-14709c1ad938": "Common Places FS Folder",
"d426cfd0-87fc-4906-98d9-a23f5d515d61": "Windows Search Service Outlook Express Protocol Handler",
"d4480a50-ba28-11d1-8e75-00c04fa31a86": "Add Network Place",
"d450a8a1-9568-45c7-9c0e-b4f9fb4537bd": "Installed Updates",
"d555645e-d4f8-4c29-a827-d93c859c4f2a": "Ease of Access",
"d5b1944e-db4e-482e-b3f1-db05827f0978": "Softex OmniPass Encrypted Folder",
"d6277990-4c6a-11cf-8d87-00aa0060f5bf": "Scheduled Tasks",
"d65231b0-b2f1-4857-a4ce-a8e7c6ea7d27": "System32",
"d8559eb9-20c0-410e-beda-7ed416aecc2a": "Windows Defender",
"d9dc8a3b-b784-432e-a781-5a1130a75963": "History",
"d9ef8727-cac2-4e60-809e-86f80a666c91": "Secure Startup (BitLocker Drive Encryption)",
"da3f6866-35fe-4229-821a-26553a67fc18": "General (Generic) library",
"daf95313-e44d-46af-be1b-cbacea2c3065": "Start Menu Provider Folder",
"de2b70ec-9bf7-4a93-bd3d-243f7881d492": "Contacts",
"de61d971-5ebc-4f02-a3a9-6c82895e5c04": "AddNewPrograms",
"de92c1c7-837f-4f69-a3bb-86e631204a23": "Playlists",
"de974d24-d9c6-4d3e-bf91-f4455120b917": "Common Files x86",
"debf2536-e1a8-4c59-b6a2-414586476aea": "GameExplorer",
"df7266ac-9274-4867-8d55-3bd661de872d": "Programs and Features",
"dfdf76a2-c82a-4d63-906a-5644ac457385": "Public",
"dffacdc5-679f-4156-8947-c5c76bc0b67f": "Delegate folder that appears in Users Files Folder",
"e17d4fc0-5564-11d1-83f2-00a0c90dc849": "Search Results Folder",
"e211b736-43fd-11d1-9efb-0000f8757fcd": "Scanners and Cameras",
"e2e7934b-dce5-43c4-9576-7fe4f75e7480": "Date and Time",
"e31ea727-12ed-4702-820c-4b6445f28e1a": "Dropbox",
"e345f35f-9397-435c-8f95-4e922c26259e": "Start Menu Path Complete Provider Folder",
"e413d040-6788-4c22-957e-175d1c513a34": "Sync Center Conflict Delegate Folder",
"e555ab60-153b-4d17-9f04-a5fe99fc15ec": "Ringtones",
"e773f1af-3a65-4866-857d-846fc9c4598a": "Shell Storage Folder Viewer",
"e7de9b1a-7533-4556-9484-b26fb486475e": "Network Map",
"e7e4bc40-e76a-11ce-a9bb-00aa004ae837": "Shell DocObject Viewer",
"e88dcce0-b7b3-11d1-a9f0-00aa0060fa31": "Compressed Folder",
"e95a4861-d57a-4be1-ad0f-35267e261739": "Windows Side Show",
"e9950154-c418-419e-a90a-20c5287ae24b": "Location and Other Sensors",
"ea25fbd7-3bf7-409e-b97f-3352240903f4": "Videos Search Results",
"ecdb0924-4208-451e-8ee0-373c0956de16": "Work Folders",
"ed228fdf-9ea8-4870-83b1-96b02cfe0d52": "My Games",
"ed4824af-dce4-45a8-81e2-fc7965083634": "Public Documents",
"ed50fc29-b964-48a9-afb3-15ebb9b97f36": "PrintHood delegate folder",
"ed7ba470-8e54-465e-825c-99712043e01c": "All Tasks",
"ed834ed6-4b5a-4bfe-8f11-a626dcb6a921": "Personalization Control Panel",
"edc978d6-4d53-4b2f-a265-5805674be568": "Stream Backed Folder",
"ee32e446-31ca-4aba-814f-a5ebd2fd6d5e": "Offline Files",
"f02c1a0d-be21-4350-88b0-7367fc96ef3c": "Network",
"f0d63f85-37ec-4097-b30d-61b4a8917118": "Photo Stream",
"f1390a9a-a3f4-4e5d-9c5f-98f3bd8d935c": "Sync Setup Delegate Folder",
"f1b32785-6fba-4fcf-9d55-7b8e7f157091": "LocalAppData",
"f2ddfc82-8f12-4cdd-b7dc-d4fe1425aa4d": "Sound",
"f38bf404-1d43-42f2-9305-67de0b28fc23": "Windows",
"f3ce0f7c-4901-4acc-8648-d5d44b04ef8f": "Users Files",
"f3f5824c-ad58-4728-af59-a1ebe3392799": "Sticky Notes Namespace Extension for Windows Desktop Search",
"f5175861-2688-11d0-9c5e-00aa00a45957": "Subscription Folder",
"f5fb2c77-0e2f-4a16-a381-3e560c68bc83": "Removable Drives",
"f6b6e965-e9b2-444b-9286-10c9152edbc5": "History Vault",
"f7f1ed05-9f6d-47a2-aaae-29d317c6f066": "Common Files",
"f82df8f7-8b9f-442e-a48c-818ea735ff9b": "Pen and Input Devices",
"f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a": "Videos",
"f8c2ab3b-17bc-41da-9758-339d7dbf2d88": "Previous Versions Results Folder",
"f90c627b-7280-45db-bc26-cce7bdd620a4": "All Tasks",
"f942c606-0914-47ab-be56-1321b8035096": "Storage Spaces",
"fb0c9c8a-6c50-11d1-9f1d-0000f8757fcd": "Scanners & Cameras",
"fbb3477e-c9e4-4b3b-a2ba-d3f5d3cd46f9": "Documents Library",
"fc9fb64a-1eb2-4ccf-af5e-1a497a9b5c2d": "My sharing folders",
"fcfeecae-ee1b-4849-ae50-685dcf7717ec": "Problem Reports and Solutions",
"fd228cb7-ae11-4ae3-864c-16f3910ab8fe": "Fonts",
"fdd39ad0-238f-46af-adb4-6c85480369c7": "Documents",
"fe1290f0-cfbd-11cf-a330-00aa00c16e65": "Directory",
"ff393560-c2a7-11cf-bff4-444553540000": "History",
}
@sf-jonstewart
Copy link
Author

sf-jonstewart commented Feb 20, 2019

Special thanks to Willi Ballenthin for his prior work on parsing shellbags in Python, to Joachim Metz for his documentation, and to Eric Zimmerman for his ShellBags Explorer tool.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment