AmcacheParser version 1.5.1.0
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/AmcacheParser
Command line: -f Amcache.hve --csv .
Warning: Administrator privileges not found!
Error parsing ProgramsEntry at {11517B7C-E79D-4e20-961B-75A811715ADD}\Root\InventoryApplication\0000f3a1ae240ab0d68d8f4673f7bc63c42c00000904. Error: Строка не распознана как действительное значение DateTime.
[...]
C:\Users\MS\Desktop\amcache\Amcache.hve is in new format!
Total file entries found: 486
Total device containers found: 141
Total device PnPs found: 105
Total drive binaries found: 284
Total driver packages found: 16
Found 18 unassociated file entry
Results saved to: .
Total parsing time: 1,323 seconds
Here is a key that isn't parsed by your tool:
Key path: Root\File\dd31621c-4f8f-11e4-9f49-806e6f6e6963\1000004513b
Last written timestamp (UTC): 2020-07-29 16:59:41.147582
Access bits: 0
Owner SID: S-1-5-32-544
[...]
Value name: 15
Value type: REG_SZ
Data size: 112
Data (decoded):
c:\program files (x86)\opera\69.0.3686.77\installer.exe^@
[...]
---
("^@" marks the null byte.)
So, the Amcache hive contains entries having both the new and old formats. Those using the old format aren't parsed (e.g., the path quoted above is missing in the CSV files).
Hello.
Here is the output of your tool:
Here is a key that isn't parsed by your tool:
("^@" marks the null byte.)
So, the Amcache hive contains entries having both the new and old formats. Those using the old format aren't parsed (e.g., the path quoted above is missing in the CSV files).
Unfortunately, I can't share the hive file.