search

markmckinnon / Autopsy-Plugins

Autopsy Python Plugins
332 stars 100 forks source link

SAM Parse Plugin Pulls from RegBack #9

Closed coolcalmcollected22 closed 2 years ago

coolcalmcollected22 commented 6 years ago

Good day sir!

When running the Parse SAM option within the Windows Internals plugin, the plugin runs with no problem. However, the source is the SAM file in the RegBack folder and not config. Is this intentional?

markmckinnon commented 6 years ago

No it is not. Are the entries for the username duplicated at all? I will take a look at the code. If you run the regular Parse SAM plugin do you get the same results?

coolcalmcollected22 commented 6 years ago

There were no duplicates, Just the entries for the 1 SAM in RegBack.

I just ran the regular Parse SAM and it pulled all 4 SAM files (config, Regback, windows.old/config & Regback) so no issues with that one.

markmckinnon commented 6 years ago

Ok, thanks for doing that. I will fix the code soon.