search

Velocidex / go-ese

Go implementation of an Extensible Storage Engine parser
Apache License 2.0
26 stars 12 forks source link

WebCacheV01.dat missing ResponseHeaders #9

Closed vicodark closed 8 months ago

vicodark commented 3 years ago

I have been looking at a few WebCacheV01.dat files and doing some spot checking to see what go-ese parses versus what ESEDatabaseView shows. In some of the Container_ tables, the ResponseHeader columns sometimes show what appears to be more valid data in ESEDatabaseView. Where it shows string data, go-ese shows just a few bytes of non-string data. The strings in these columns can be pretty long (KBs). In digging around the go-ese code and documentation, I keep seeing hints that Long Values may not be implemented. Is that possibly the case, and a possible cause?

scudette commented 8 months ago

This was a problem with long values. So this issue is a duplicate of #21 and fixed by #22