Closed Bloggzy closed 1 year ago
Implemented. Thanks for reporting!
Possibly because of the usage of Windows 10 Enterprise Evaluation and/or an unfinished Windows setup.
# Timezone Information
if (Test-Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\TimeZoneInformation")
{
<snip>
}
else
{
Write-Host "[Error] TimeZoneInformation Registry Subkey does NOT exist." -ForegroundColor Red
}
Nice work.
When analyzing the "Desktop" image (https://dfirmadness.com/case001/DESKTOP-SDN1RPT-memory.zip) from the Stolen Szechuan Sauce challenge (https://dfirmadness.com/the-stolen-szechuan-sauce/), I saw some errors being thrown as the TimeZoneInformation registry locations didn't exist.
Get-Content : Cannot find path 'X:\registry\HKLM\SYSTEM\ControlSet001\Control\TimeZoneInformation\TimeZoneKeyName.txt' because it does not exist.
At C:\Demo\MPFSA\MemProcFS-Analyzer-v0.6\MemProcFS-Analyzer.ps1:1880 char:28
Get-Content : Cannot find path 'X:\registry\HKLM\SYSTEM\ControlSet001\Control\TimeZoneInformation\(_Key_).txt' because it does not exist.
At C:\Demo\MPFSA\MemProcFS-Analyzer-v0.6\MemProcFS-Analyzer.ps1:1881 char:26
Get-Content : Cannot find path 'X:\registry\HKLM\SYSTEM\ControlSet001\Control\TimeZoneInformation\ActiveTimeBias.txt' because it does not exist.
At C:\Demo\MPFSA\MemProcFS-Analyzer-v0.6\MemProcFS-Analyzer.ps1:1882 char:27
In the analyzer script (v0.6) under the "# Timezone Information" section (lines: 1879-1882) you could possibly include a few checks and handle it in case those files don't exist?
e.g. if (Test-Path "") or similar?