EricZimmerman / EricZimmerman/Issues
AmcacheParser ignores "old format" entries if "new format" entries are found
- Dominant language
- No language data
- Stars
- 14
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Hello.
Here is the output of your tool:
```
AmcacheParser version 1.5.1.0
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/AmcacheParser
Command line: -f Amcache.hve --csv .
Warning: Administrator privileges not found!
Error parsing ProgramsEntry at {11517B7C-E79D-4e20-961B-75A811715ADD}\Root\InventoryApplication\0000f3a1ae240ab0d68d8f4673f7bc63c42c00000904. Error: Строка не распознана как действительное значение DateTime.
[...]
C:\Users\MS\Desktop\amcache\Amcache.hve is in new format!
Total file entries found: 486
Total device containers found: 141
Total device PnPs found: 105
Total drive binaries found: 284
Total driver packages found: 16
Found 18 unassociated file entry
Results saved to: .
Total parsing time: 1,323 seconds
```
Here is a key that isn't parsed by your tool:
```
Key path: Root\File\dd31621c-4f8f-11e4-9f49-806e6f6e6963\1000004513b
Last written timestamp (UTC): 2020-07-29 16:59:41.147582
Access bits: 0
Owner SID: S-1-5-32-544
[...]
Value name: 15
Value type: REG_SZ
Data size: 112
Data (decoded):
c:\program files (x86)\opera\69.0.3686.77\installer.exe^@
[...]
---
```
("^@" marks the null byte.)
So, the Amcache hive contains entries having both the new and old formats. Those using the old format aren't parsed (e.g., the path quoted above is missing in the CSV files).
Unfortunately, I can't share the hive file.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.