Closed GoogleCodeExporter closed 8 years ago
This is due to the fact that
-m prepends what you say to the filename.
You are running it with F: as the first path, which makes the tool pre-pend c:
in front of that.
Quick simple solution would be to:
F:
log2timeline.pl -m C: -r -f win7 -w c:\bodyfile.csv -p .
(forgot to run the -p option)
Original comment by ki...@kiddaland.net
on 24 May 2012 at 6:13
Issue 6 has been merged into this issue.
Original comment by ki...@kiddaland.net
on 24 May 2012 at 6:15
Ok I ran
F:
log2timeline.pl -m C: -r -f win7 -w c:\bodyfile.csv -p .
The filename column looks good know.
For "Log2t::input::sol", the desc column is like this:
LSO created -> File: C:/./Users/blah/AppData/Roaming/Macromedia/Flash
Player/macromedia.com/support/flashplayer/sys/#foo.com/settings.sol and object
name: foo.com/settings variable: {allow = (FALSE) }
w_lastauto -> File: C:/./Users/blah/AppData/Roaming/Macromedia/Flash
Player/macromedia.com/support/flashplayer/sys/#foo.com/settings.sol and object
name: foo.com/settings variable: {allow = (FALSE) }
there is an extra "/." in the file
For "Log2t::input::recycler", the desc column is like this:
C:/Users/blah/Temp/TCD127F.tmp <-./$Recycle.Bin/S-1-5-21-XXX-YYY/$IOT9GAR.tmp
i.e. C: is not prepended before /$Recycle.Bin
Original comment by antoine....@gmail.com
on 25 May 2012 at 1:00
this should be fixed by now
(http://code.google.com/p/log2timeline/source/detail?r=bd9d33f84988704dcb058dff8
0ce0c2a0f9cfd5c)
Original comment by ki...@kiddaland.net
on 28 May 2012 at 5:27
Original issue reported on code.google.com by
antoine....@gmail.com
on 24 May 2012 at 5:38