search

EricZimmerman / RECmd

Command line access to the Registry
MIT License
130 stars 31 forks source link

RLA #54

Closed gunner4361 closed 4 months ago

gunner4361 commented 9 months ago

Command line: -d D:\test\DESKTOP-1\uploads\auto\C\Users\b --out D:\test\DESKTOP-1\uploads\auto\C\Users\b\t

    Hives found: 2
Processing hive D:\test\DESKTOP-1\uploads\auto\C\Users\b\NTUSER.DAT
Two transaction logs found. Determining primary log...
Primary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG2, secondary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG1
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG2
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG1
At least one transaction log was applied. Sequence numbers have been updated to 0x100A12. New Checksum: 0xAF344325
There was an error: Index was outside the bounds of the array.
System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at rla.Program.DoWork(String f, String d, String out, Boolean ca, Boolean cn, Boolean debug, Boolean trace)

Processing hive D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat
Two transaction logs found. Determining primary log...
Primary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2, secondary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
At least one transaction log was applied. Sequence numbers have been updated to 0x2C393. New Checksum: 0x449B1856
There was an error: Index was outside the bounds of the array.
System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at rla.Program.DoWork(String f, String d, String out, Boolean ca, Boolean cn, Boolean debug, Boolean trace)
AndrewRathbun commented 9 months ago

What version of RLA were you using?

EricZimmerman commented 9 months ago

I have a fix for registry that may be related that involves transaction log size.

Let us know the version of rla tho and if you can share those files that cause this.

EricZimmerman commented 4 months ago

No hives. Nothing to do.