The bytes of an ItemID belong to the shell folder that made it. MS-SHLLINK does not describe them and Microsoft does not publish them. What follows comes from Joachim Metz’s reverse-engineered libfwsi documentation, and only covers the kinds this site’s viewer reads. Their layouts have changed between Windows versions.
What every item starts with
0Size the item’s size, in bytes22Class type indicator what kind of item this is13the item’s own datavaries
| Class type | Item |
|---|---|
0x1F | Root folder |
0x20–0x2F | Volume |
0x30–0x3F | File entry |
0x40–0x4F | Network location |
0x61 | URI: shown as bytes |
0x71 | Control Panel item: a class ID at offset 14 |
| Others | Shown as bytes |
Root folder (0x1F)
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 2 | Size | The item’s size. |
| 2 | 1 | Class type | 0x1F. |
| 3 | 1 | Sort index | The folder’s position among its siblings. |
| 4 | 16 | Shell folder ID | A class ID, such as {20D04FE0-3AEA-1069-A2D8-08002B30309D} for Computer. |
| 20 | varies | Extension data | Optional; not read by this site’s viewer. |
Volume (0x20–0x2F)
When bit 0 of the class type is set, the item holds a drive name:
| Offset | Size | Name | Description |
|---|---|---|---|
| 3 | 20 | Volume name | ASCII, filled with zeros, for example C:\. |
| 23 | 2 | Unknown | Present when the item is more than 25 bytes. |
| 25 | 16 | Shell folder ID | Optional class ID. |
When bit 0 is clear, the item holds a class ID instead:
| Offset | Size | Name | Description |
|---|---|---|---|
| 3 | 1 | Flags | A flags byte. |
| 4 | 16 | Shell folder ID | A class ID for the volume. |
File entry (0x30–0x3F)
The class type’s low bits: 0x01 directory, 0x02 file, 0x04 the name is UTF-16. 0x80 means a class identifier follows.
| Offset | Size | Name | Description |
|---|---|---|---|
| 3 | 1 | Unknown | Usually zero. |
| 4 | 4 | File size | The size of the file in bytes. |
| 8 | 4 | Modified | A FAT date and time: the date in the low 16 bits, the time in the high 16 bits. UTC. |
| 12 | 2 | Attributes | The file attribute flags. |
| 14 | varies | Primary name | Zero-terminated, the short name on systems that have one. ASCII unless flag 0x04 is set, and padded to an even offset. |
| … | varies | Extension blocks | Windows XP and later. See Extension blocks. |
| last 2 | 2 | First extension offset | The offset of the first extension block. |
Extension blocks
A file entry’s extra data is a run of blocks, each starting with the same three
fields. The signature’s high 16 bits are BEEF.
| Offset | Size | Name | Description |
|---|---|---|---|
| 0 | 2 | Size | The block’s size, these bytes included. |
| 2 | 2 | Version | Later fields depend on it. |
| 4 | 4 | Signature | 0xBEEF0004 is the file entry extension below. |
The 0xBEEF0004 block holds, after those eight bytes:
| Size | Present from | Name | Description |
|---|---|---|---|
| 4 | all | Created | A FAT date and time. |
| 4 | all | Accessed | A FAT date and time. |
| 2 | all | Long name offset | From the start of this block. |
| 2 | version 7 | Empty | Two empty bytes. |
| 8 | version 7 | File reference | The NTFS file reference: MFT entry and sequence number. |
| 8 | version 7 | Unknown | Purpose not known. |
| 2 | version 3 | Localised name offset | From the start of this block; zero if there is no localised name. |
| 4 | version 9 | Empty | Four empty bytes. |
| 4 | version 8 | Unknown | Purpose not known. |
| varies | version 3 | Long name | UTF-16, zero-terminated. |
| 2 | version 3 | First extension offset | From the start of the shell item. |
Version 3 is Windows XP and 2003, 7 is Vista, 8 is 2008, 7 and 8.0, and 9 is 8.1 and 10.
Network location (0x40–0x4F)
| Offset | Size | Name | Description |
|---|---|---|---|
| 3 | 1 | Unknown | Purpose not known. |
| 4 | 1 | Flags | 0x80: a description follows the location. 0x40: comments follow. |
| 5 | varies | Location | ASCII, zero-terminated: a server, share or domain. |
| … | varies | Description | If flagged. ASCII, zero-terminated. |
| … | varies | Comments | If flagged. ASCII, zero-terminated. |