Add TypedPaths registry plugin - #1
Open
thunderstornX wants to merge 1 commit into
Open
Conversation
Parse the Explorer TypedPaths key from the NTUSER hive to recover paths and locations a user typed into the address bar, including local, removable, and UNC/remote paths. Mirrors the RunMRU plugin: adds the RegTypedPaths plugin, its configuration/registry/typed_paths.xml field and timeline mapping, and a unit test against the sample NTUSER.dat.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
TypedPathsplugin that parses theTypedPathskey from theNTUSERhive.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPathsrecords the paths and locations a user typed into the Windows Explorer address bar (url1is the most recent). It is a useful forensic artefact: it reveals folders, drives, and UNC/remote paths a user navigated to manually, which the existing plugins did not cover.Implementation
Mirrors the existing
RunMRUregistry plugin:src/dfir_ogre_plugin_windows/registry/typed_paths.py—RegTypedPathsglobs theTypedPathskey and emits one record perurlNvalue (path, index, key path, key modification time, key security).configuration/registry/typed_paths.xml— field definitions and timeline mapping. Thepathfield uses theFILE_PATHqualifier, consistent with other path fields in the project.src/dfir_ogre_plugin_windows/__init__.py— a single import; the plugin is then auto-discovered viaOgrePlugin.__subclasses__().Testing
tests/hive/test_typed_paths.pyruns the plugin against the existingtests/data/hive/NTUSER.datsample and asserts the two recovered entries (url1 = C:\,url2 = \\10.0.0.3\Share).python -m unittest tests.hive.test_typed_paths -vpasses.RegTypedPathsappears indfir-ogre-plugin list.