deardaniel/secdata-raw huggingface dataset:
Windows Registry Knowledge Base: Known folder identifiers

# Known folder identifier keys

A known folder identifier is a GUID that identifies a system folder. It was
introduced in Windows Vista to replace the constant special item identifier list
(CSIDL).

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
```

Values:

Name | Data type | Description
--- | --- | ---
Attributes | REG_DWORD | 
Category | REG_DWORD | 
Name | REG_SZ | Name of the known folder
LocalizedName | REG_EXPAND_SZ | Localized name of the known folder
ParentFolder | REG_SZ | Path of the parent directory known folder, can contain a known folder identifier
PreCreate | REG_DWORD | 
RelativePath | REG_SZ | Relative path of the known folder

### LocalizedName value data

The LocalizedName value contains a localized version of the folder name, e.g.
on Windows XP the folder identifier key:

```
HKEY_CLASSES_ROOT\CLSID\{450d8fba-ad25-11d0-98a8-0800361b1103}
```

Has a LocalizedString value with the following data:

```
@%SystemRoot%\system32\SHELL32.dll,-9227
```

Which is the [MUI Form](https://winreg-kb.readthedocs.io/en/latest/sources/windows-registry/MUI-form.html)
for "My Documents".

## External links

* [libfwsi: Known Folder Identifiers](https://github.com/libyal/libfwsi/wiki/Known-Folder-Identifiers)
Windows Registry Knowledge Base: MUI cache

# Multilingual User Interface (MUI) cache

Seen on Windows XP and 2003

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
```

Seen on Windows Vista and later

```
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
```
Windows Registry Knowledge Base: Shell folders

# Shell folders

Shell Folder identifiers are class identifiers with Shell Folder sub key. In
the Windows Registry Some Class identifiers (CLSID) have a ShellFolder sub key
for example:

```
HKEY_LOCAL_MACHINE\Software\CLSID\{%GUID%}\ShellFolder
```

Where {%GUID%} is a GUID in the form: {[PII_REDACTED]-[PII_REDACTED]}.

A shell folder can be system or user specific.

System shell folders:

```
HKEY_CURRENT_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Backup
```

WoW64 (Windows 32-bit on Windows 64-bit) system shell folders:

```
HKEY_CURRENT_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Backup
```

Per-user shell folders:

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
```

Values:

Name | Data type | Description
--- | --- | ---
%NAME% | REG_SZ or REG_EXPAND_SZ | Path to the corresponding directory
Windows Registry Knowledge Base: Typed paths

# Typed paths

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
```

Value| Data type| Description
--- | --- | ---
%ITEM% | REG_SZ | Where %ITEM% is a string in the form: "url[0-9]+"
Windows Registry Knowledge Base: Control panel item identifiers

# Control panel item identifiers

A control panel item identifier is a GUID that identifies a specific control
panel item.

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{%GUID%}
```

Values:

Name | Data type | Description
--- | --- | ---
Category | REG_DWORD | 
(default) | REG_SZ | Module name of the control panel item
PreferredPlan | REG_SZ |
Log2timeline timeline generation: README

## Plaso (Plaso Langar Að Safna Öllu) - super timeline all the things

Plaso (Plaso Langar Að Safna Öllu), or *super timeline all the things*, is a
Python-based engine used by several tools for automatic creation of timelines.
Plaso default behavior is to create super timelines but it also supports
creating more [targeted timelines](http://blog.kiddaland.net/2013/02/targeted-timelines-part-i.html).

These timelines support digital forensic investigators/analysts, to correlate
the large amount of information found in logs and other files found on an
average computer.

### A longer version

The initial purpose of Plaso was to collect all timestamped events of interest 
on a computer system and have them aggregated in a single place for computer 
forensic analysis (aka Super Timeline).

However Plaso has become a framework that supports:

* adding new parsers or parsing plug-ins;
* adding new analysis plug-ins;
* writing one-off scripts to automate repetitive tasks in computer forensic analysis or equivalent.

And is moving to support:

* adding new general purpose parses/plugins that may not have timestamps associated to them;
* adding more analysis context;
* tagging events;
* allowing more targeted approach to the collection/parsing.

### Also see

* [Homepage](https://github.com/log2timeline/plaso)
* [Downloads](https://github.com/log2timeline/plaso/releases)
* [Documentation](https://plaso.readthedocs.io)
* Contact information:
  * Plaso channel on [Open Source DFIR Slack community](https://github.com/open-source-dfir/slack)
  * Mailing list for general discussions: [log2timeline-discuss](https://groups.google.com/forum/#%21forum/log2timeline-discuss)
  * Mailing list for development: [log2timeline-dev](https://groups.google.com/forum/#%21forum/log2timeline-dev)
Log2timeline timeline generation: powershell transcript

﻿**********************
Windows PowerShell transcript start
Start time:[PII_REDACTED]3749
Username: MSEDGEWIN10\IEUser
RunAs User: MSEDGEWIN10\IEUser
Configuration Name:
Machine: MSEDGEWIN10 (Microsoft Windows NT 10.0.17763.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Process ID: 6456
PSVersion: 5.1.17763.1852
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17763.1852
BuildVersion: 10.0.17763.1852
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS C:\Windows\system32> whoami
msedgewin10\ieuser
**********************
Windows PowerShell transcript end
End time:[PII_REDACTED]3759
**********************
Log2timeline timeline generation: sav

20100720 183814 File "C:\Documents and Settings\Administrator\Desktop\sxl_test_50.com" belongs to virus/spyware 'LiveProtectTest'.
20100720 183818 File sample was successfully sent for Sophos Live Protection: File: 'C:\Documents and Settings\Administrator\Desktop\sxl_test_50.com' Checksum: 'a2c0f84a30bec1279a6591ceae76f75d47c3fe81.5'
20160923 084229 Control of  "\\192.168.z.y\ONTAP_ADMIN$\vol\DATA\DATA\Something\Somethingelse.docx" returned a SAV error Interface 0xa0040212: File is crypted.
20160923 084725 Running version 5.31 of data detection (detection engine 3.64.3). This version detects 11947014 elements.
20160926 122635 File "C:\Tempo\EicarTest.txt" belongs to virus/spyware 'EICAR-AV-Test'.
20160926 122636 The file "C:\Tempo\EicarTest.txt" was cleaned.
20160926 122637 The virus/spyware 'EICAR-AV-Test' was deleted.
20160926 123249 Infected file "\\192.168.103.244\ONTAP_ADMIN$\vol\\eicar - Copie.txt" moved in "C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED\eicar - Copie.txt.000".
20160926 123249 Virus/spyware 'EICAR-AV-Test' detected in '\\192.168.103.244\ONTAP_ADMIN$\vol\Echange\eicar - Copie.txt'. Cleaning impossible.
Log2timeline timeline generation: PcaAppLaunchDic

C:\Program Files\WindowsApps\MicrosoftTeams_22[PII_REDACTED].9453_x64__8wekyb3d8bbwe\msteams.exe|2022-11-15 00:02:08.476
C:\Program Files\Microsoft VS Code\Code.exe|2023-01-21 04:14:27.856
C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe|2023-01-03 05:20:36.261
C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2209.6.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe|2022-11-30 01:01:29.898
Log2timeline timeline generation: powershell transcript ger

﻿**********************
nStart der Windows PowerShell-Aufzeichnung
Startzeit:[PII_REDACTED]2111
Benutzername: DE\User
RunAs-Benutzer: DE\User
Konfigurationsname:
Computer: MySystem (Microsoft Windows NT 10.0.19044.0)
Hostanwendung: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Prozess-ID: 18716
PSVersion: 5.1.19041.1682
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.19041.1682
BuildVersion: 10.0.19041.1682
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Die Aufzeichnung wurde gestartet. Die Ausgabedatei ist "C:\Users\User\Documents\PowerShell_transcript.MySystem.rvARGulQ[PII_REDACTED]2111.txt".
PS C:\Users\User> whoami
de\User
PS C:\Users\User> echo $null >> filename
PS C:\Users\User> ping 8.8.8.8

Ping wird ausgeführt für 8.8.8.8 mit 32 Bytes Daten:
Zeitüberschreitung der Anforderung.

Ping-Statistik für 8.8.8.8:
    Pakete: Gesendet = 1, Empfangen = 0, Verloren = 1
    (100% Verlust),
STRG-C
PS C:\Users\User> TerminatingError(): "Die Pipeline wurde beendet."
>> TerminatingError(): "Die Pipeline wurde beendet."
PS C:\Users\User> Get-Content .\myfile.txt
VERBOSE: Simple Test
**********************
Befehlsstartzeit:[PII_REDACTED]3114
**********************
PS C:\Users\User\Documents> ping 127.0.0.1 -n 5

Ping wird ausgeführt für 127.0.0.1 mit 32 Bytes Daten:
Antwort von 127.0.0.1: Bytes=32 Zeit<1ms TTL=128
Antwort von 127.0.0.1: Bytes=32 Zeit<1ms TTL=128
Antwort von 127.0.0.1: Bytes=32 Zeit<1ms TTL=128
Antwort von 127.0.0.1: Bytes=32 Zeit=1ms TTL=128
Antwort von 127.0.0.1: Bytes=32 Zeit<1ms TTL=128

Ping-Statistik für 127.0.0.1:
    Pakete: Gesendet = 5, Empfangen = 5, Verloren = 0
    (0% Verlust),
Ca. Zeitangaben in Millisek.:
    Minimum = 0ms, Maximum = 1ms, Mittelwert = 0ms
**********************
Befehlsstartzeit:[PII_REDACTED]4237
**********************
PS C:\Users\User> rm .\filename
Log2timeline timeline generation: PcaGeneralDb0

2022-11-14 23:37:11.789|2|%programfiles%\windowsapps\microsoftteams_22[PII_REDACTED].9453_x64__8wekyb3d8bbwe\msteamsupdate.exe|microsoft teams updater|microsoft corporation|22[PII_REDACTED].9453|[PII_REDACTED]b1e64961e910ee21d4352afe[PII_REDACTED]|Abnormal process exit with code 0x4c7
2022-11-15 00:00:11.751|2|%programfiles%\microsoft vs code\resources\app\node_modules.asar.unpacked\@vscode\ripgrep\bin\rg.exe||||0000e6b26ba7b04397534ea87b0142a0deae0000ffff|Abnormal process exit with code 0x1
2022-11-15 00:00:17.499|2|\program files\git\mingw64\bin\git.exe|git|the git development community|2.33.0.windows.2|0000cf6bcbd173601d5a06d08c5c197a52c40000ffff|Abnormal process exit with code 0x1
Log2timeline timeline generation: Connections

[PII_REDACTED]                      20-02-2024 13:10:33             20-02-2024 13:11:52             IEUser                          RemoteControl                   {b35110b2-7dc5-4bb9-8d54-ca80953f65f8}
Log2timeline timeline generation: invalid encoding

application_exection
  data_type is 'windows:prefetch'

file_downloaded
  data_type is 'chrome:history:file_downloaded'
  timestamp_desc is 'File Downloaded'

login_attempt
  data_type == 'windows:evt:record' and source_name == 'Security' and event_identifier == 538

security_event
  data_type == 'windows:evt:record' and source_name == 'Security'

text_contains
  body contains 'a message'
Log2timeline timeline generation: invalid syntax

Application Execution
  data_type is 'windows:prefetch'

Invalid Tag
  some text here

Partially Valid Tag
  filename contains '/tmp/whoaaaa'
  some other invalid text.
Log2timeline timeline generation: valid

application_execution
  data_type is 'windows:prefetch'

file_downloaded
  data_type is 'chrome:history:file_downloaded'
  timestamp_desc is 'File Downloaded'

login_attempt
  data_type == 'windows:evt:record' and source_name == 'Security' and event_identifier == 538

security_event
  data_type == 'windows:evt:record' and source_name == 'Security'

text_contains
  body contains 'a message'
Log2timeline timeline generation: index

Welcome to the Plaso documentation
=======================================

Plaso (Plaso Langar Að Safna Öllu), or *super timeline all the things*, is a
Python-based engine used by several tools for automatic creation of timelines.
Plaso default behavior is to create super timelines but it also supports
creating more `targeted timelines <http://blog.kiddaland.net/2013/02/targeted-timelines-part-i.html>`__.

These timelines support digital forensic investigators/analysts, to correlate
the large amount of information found in logs and other files found on an
average computer.

The source code is available from the `project page <https://github.com/log2timeline/plaso>`__.

.. toctree::
   :maxdepth: 2

   sources/user/index

.. toctree::
   :maxdepth: 2

   sources/developer/index

.. toctree::
   :maxdepth: 2

   Troubleshooting <sources/Troubleshooting>

.. toctree::
   :maxdepth: 2

   Supported formats <sources/Supported-formats>

.. toctree::
   :maxdepth: 2

   API documentation <sources/api/plaso>


Indices and tables
==================

* :ref:`genindex`
* :ref:`modindex`
Log2timeline timeline generation: plaso.storage.fake

plaso.storage.fake package
==========================

Submodules
----------

plaso.storage.fake.event\_heap module
-------------------------------------

.. automodule:: plaso.storage.fake.event_heap
   :members:
   :show-inheritance:
   :undoc-members:

plaso.storage.fake.fake\_store module
-------------------------------------

.. automodule:: plaso.storage.fake.fake_store
   :members:
   :show-inheritance:
   :undoc-members:

plaso.storage.fake.writer module
--------------------------------

.. automodule:: plaso.storage.fake.writer
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.storage.fake
   :members:
   :show-inheritance:
   :undoc-members:
Log2timeline timeline generation: plaso.scripts

plaso.scripts package
=====================

Submodules
----------

plaso.scripts.image\_export module
----------------------------------

.. automodule:: plaso.scripts.image_export
   :members:
   :show-inheritance:
   :undoc-members:

plaso.scripts.log2timeline module
---------------------------------

.. automodule:: plaso.scripts.log2timeline
   :members:
   :show-inheritance:
   :undoc-members:

plaso.scripts.pinfo module
--------------------------

.. automodule:: plaso.scripts.pinfo
   :members:
   :show-inheritance:
   :undoc-members:

plaso.scripts.psort module
--------------------------

.. automodule:: plaso.scripts.psort
   :members:
   :show-inheritance:
   :undoc-members:

plaso.scripts.psteal module
---------------------------

.. automodule:: plaso.scripts.psteal
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.scripts
   :members:
   :show-inheritance:
   :undoc-members:
Log2timeline timeline generation: plaso.formatters

plaso.formatters package
========================

Submodules
----------

plaso.formatters.chrome module
------------------------------

.. automodule:: plaso.formatters.chrome
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.chrome\_preferences module
-------------------------------------------

.. automodule:: plaso.formatters.chrome_preferences
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.default module
-------------------------------

.. automodule:: plaso.formatters.default
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.file\_system module
------------------------------------

.. automodule:: plaso.formatters.file_system
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.firefox module
-------------------------------

.. automodule:: plaso.formatters.firefox
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.interface module
---------------------------------

.. automodule:: plaso.formatters.interface
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.logger module
------------------------------

.. automodule:: plaso.formatters.logger
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.manager module
-------------------------------

.. automodule:: plaso.formatters.manager
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.msiecf module
------------------------------

.. automodule:: plaso.formatters.msiecf
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.shell\_items module
------------------------------------

.. automodule:: plaso.formatters.shell_items
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.winevt module
------------------------------

.. automodule:: plaso.formatters.winevt
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.winlnk module
------------------------------

.. automodule:: plaso.formatters.winlnk
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.winprefetch module
-----------------------------------

.. automodule:: plaso.formatters.winprefetch
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.winreg module
------------------------------

.. automodule:: plaso.formatters.winreg
   :members:
   :show-inheritance:
   :undoc-members:

plaso.formatters.yaml\_formatters\_file module
----------------------------------------------

.. automodule:: plaso.formatters.yaml_formatters_file
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.formatters
   :members:
   :show-inheritance:
   :undoc-members:
Log2timeline timeline generation: plaso.parsers.olecf plugins

plaso.parsers.olecf\_plugins package
====================================

Submodules
----------

plaso.parsers.olecf\_plugins.automatic\_destinations module
-----------------------------------------------------------

.. automodule:: plaso.parsers.olecf_plugins.automatic_destinations
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.olecf\_plugins.default module
-------------------------------------------

.. automodule:: plaso.parsers.olecf_plugins.default
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.olecf\_plugins.interface module
---------------------------------------------

.. automodule:: plaso.parsers.olecf_plugins.interface
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.olecf\_plugins.summary module
-------------------------------------------

.. automodule:: plaso.parsers.olecf_plugins.summary
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.parsers.olecf_plugins
   :members:
   :show-inheritance:
   :undoc-members:
Log2timeline timeline generation: plaso.analyzers.hashers

plaso.analyzers.hashers package
===============================

Submodules
----------

plaso.analyzers.hashers.entropy module
--------------------------------------

.. automodule:: plaso.analyzers.hashers.entropy
   :members:
   :show-inheritance:
   :undoc-members:

plaso.analyzers.hashers.interface module
----------------------------------------

.. automodule:: plaso.analyzers.hashers.interface
   :members:
   :show-inheritance:
   :undoc-members:

plaso.analyzers.hashers.manager module
--------------------------------------

.. automodule:: plaso.analyzers.hashers.manager
   :members:
   :show-inheritance:
   :undoc-members:

plaso.analyzers.hashers.md5 module
----------------------------------

.. automodule:: plaso.analyzers.hashers.md5
   :members:
   :show-inheritance:
   :undoc-members:

plaso.analyzers.hashers.sha1 module
-----------------------------------

.. automodule:: plaso.analyzers.hashers.sha1
   :members:
   :show-inheritance:
   :undoc-members:

plaso.analyzers.hashers.sha256 module
-------------------------------------

.. automodule:: plaso.analyzers.hashers.sha256
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.analyzers.hashers
   :members:
   :show-inheritance:
   :undoc-members:
Log2timeline timeline generation: plaso.winnt

plaso.winnt package
===================

Module contents
---------------

.. automodule:: plaso.winnt
   :members:
   :undoc-members:
   :show-inheritance:
Log2timeline timeline generation: plaso.parsers.esedb plugins

plaso.parsers.esedb\_plugins package
====================================

Submodules
----------

plaso.parsers.esedb\_plugins.file\_history module
-------------------------------------------------

.. automodule:: plaso.parsers.esedb_plugins.file_history
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.esedb\_plugins.interface module
---------------------------------------------

.. automodule:: plaso.parsers.esedb_plugins.interface
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.esedb\_plugins.msie\_webcache module
--------------------------------------------------

.. automodule:: plaso.parsers.esedb_plugins.msie_webcache
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.esedb\_plugins.srum module
----------------------------------------

.. automodule:: plaso.parsers.esedb_plugins.srum
   :members:
   :show-inheritance:
   :undoc-members:

plaso.parsers.esedb\_plugins.user\_access\_logging module
---------------------------------------------------------

.. automodule:: plaso.parsers.esedb_plugins.user_access_logging
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.parsers.esedb_plugins
   :members:
   :show-inheritance:
   :undoc-members:
Log2timeline timeline generation: plaso.parsers.shared

plaso.parsers.shared package
============================

Submodules
----------

plaso.parsers.shared.shell\_items module
----------------------------------------

.. automodule:: plaso.parsers.shared.shell_items
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: plaso.parsers.shared
   :members:
   :show-inheritance:
   :undoc-members: