File mru - Githubissues

barbyfernicola commented 7 years ago

Submitting a Pull Request based on Conversation I had with Dave Hull to update FileMRU.cs to support Office 2016/O365 Instances and fix some issues.

Issue: Multiple Office Version Registry keys can exist, existing code was identifying first one and exiting (i.e. 11, 12, 14 <- stop at 11. Resolution: Moved lookup of OfficeKey and Versions to File MRU since to properly identify what versions of office have the valid version/Recent Items, need to loop through each version
Issue: Newer versions of Office i.e. Office 2016 can have other configuration registry values underneath File MRU Resolution: Changed the if statement from Not "Max Displays" to Begins With Item -Issue: "Microsoft Office is not installed on this system" message was deceiving, updated to "Microsoft Office is not installed on this system or has not been opened by this User" since the existence of the registry key could just be that the user has not opened Office
Issue: "Office 365 versions of Office store their Recent Items underneath \UserMRU\AD_\FileMRU - updated to support new location

jaredcatkinson commented 7 years ago

Awesome! Thanks for submitting the PR! I am on-site today and tomorrow, so I will take a look this weekend and hopefully get this merged!

bwhite00 commented 6 years ago

Hi Jared, were you able to review this PR for inclusion?

Invoke-IR / PowerForensics