Microsoft Specific Structures

The Microsoft Specific Structures parser, allows you to decode advanced structures
   - from any document type (file, memory, registry, OLE stream, ...)
   - at any address

The following advanced structures are supported:
   - Shell Links
   - Automatic Destinations Shell Links
   - Custom Destinations Shell Links
   - Shell Item ID (also known as PIDL / ITEMIDLIST / SHITEMID)
   - Serialized Property Store
   - Serialized Property Storage
   - Task Bar items from registry "Favorites"
   - Task Bar items from registry "FavoritesResolve"




Example, for checking a Shell Bag MRU content,

First open the MRU registry key With "Open Menu" / "Open Registry Key Value"



Once opened, click the toolbar button for adding Microsoft structures decoding
After choosing "Shell Item ID List" you will get the following result