Skip to content

Add TypedPaths registry plugin - #1

Open
thunderstornX wants to merge 1 commit into
ANSSI-FR:mainfrom
thunderstornX:add-typed-paths-plugin
Open

Add TypedPaths registry plugin#1
thunderstornX wants to merge 1 commit into
ANSSI-FR:mainfrom
thunderstornX:add-typed-paths-plugin

Conversation

@thunderstornX

Copy link
Copy Markdown

Summary

Adds a TypedPaths plugin that parses the TypedPaths key from the NTUSER hive.

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths records the paths and locations a user typed into the Windows Explorer address bar (url1 is the most recent). It is a useful forensic artefact: it reveals folders, drives, and UNC/remote paths a user navigated to manually, which the existing plugins did not cover.

Implementation

Mirrors the existing RunMRU registry plugin:

  • src/dfir_ogre_plugin_windows/registry/typed_paths.pyRegTypedPaths globs the TypedPaths key and emits one record per urlN value (path, index, key path, key modification time, key security).
  • configuration/registry/typed_paths.xml — field definitions and timeline mapping. The path field uses the FILE_PATH qualifier, consistent with other path fields in the project.
  • src/dfir_ogre_plugin_windows/__init__.py — a single import; the plugin is then auto-discovered via OgrePlugin.__subclasses__().

Testing

  • tests/hive/test_typed_paths.py runs the plugin against the existing tests/data/hive/NTUSER.dat sample and asserts the two recovered entries (url1 = C:\, url2 = \\10.0.0.3\Share).
  • python -m unittest tests.hive.test_typed_paths -v passes.
  • RegTypedPaths appears in dfir-ogre-plugin list.
  • No regressions: the unittest suite returns the same result with and without this change, plus the one added passing test.

Parse the Explorer TypedPaths key from the NTUSER hive to recover paths and locations a user typed into the address bar, including local, removable, and UNC/remote paths. Mirrors the RunMRU plugin: adds the RegTypedPaths plugin, its configuration/registry/typed_paths.xml field and timeline mapping, and a unit test against the sample NTUSER.dat.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant