mkorman90 / regipy

Regipy is an os independent python library for parsing offline registry hives
MIT License
244 stars 53 forks source link

Typed Paths Artifact #241

Closed andreisss closed 1 year ago

andreisss commented 2 years ago

This key shows what you have manually typed a path into the Start menu or into the Explorer bar. The values are not written to the key until the Explorer window is closed.

mkorman90 commented 2 years ago

I really appreciate your contribution! Can you add a test, possibly based on one of the existing hive files? Let me know if you need help :)

andreisss commented 2 years ago

I really appreciate your contribution! Can you add a test, possibly based on one of the existing hive files? Let me know if you need help :)

Hi,

Yes, you can see this test with your file: NTUSER_BAGMRU.DAT test_1

This is the output generated from the file.

{ "typed_paths": { "last_write": "2022-02-06T13:46:04.945080+00:00", "entries": [ { "url1": "cmd" }, { "url2": "C:\Offline\AD" }, { "url3": "git" }, { "url4": "powershell" }, { "url5": "C:\Program Files" }, { "url6": "Network" }, { "url7": "\\wsl$\Ubuntu\projects\CAD316_001\partition_p1" }, { "url8": "\\wsl$\Ubuntu\projects" }, { "url9": "\\wsl$\Ubuntu" }, { "url10": "C:\Users\tony\Github" }, { "url11": "C:\Users\tony\Github\velocity-client-master" }, { "url12": "C:\Users\tony\Github\cogz" }, { "url13": "C:\Users\tony\Github\cogz\cogz" }, { "url14": "Quick access" }, { "url15": "C:\ProgramData\chocolatey\lib\yara\tools" }, { "url16": "C:\Training\MT01\exercise" } ] } }

mkorman90 commented 2 years ago

I really appreciate your contribution! Can you add a test, possibly based on one of the existing hive files? Let me know if you need help :)

Hi,

Yes, you can see this test with your file: NTUSER_BAGMRU.DAT test_1

This is the output generated from the file.

{ "typed_paths": { "last_write": "2022-02-06T13:46:04.945080+00:00", "entries": [ { "url1": "cmd" }, { "url2": "C:\Offline\AD" }, { "url3": "git" }, { "url4": "powershell" }, { "url5": "C:\Program Files" }, { "url6": "Network" }, { "url7": "\wsl$\Ubuntu\projects\CAD316_001\partition_p1" }, { "url8": "\wsl$\Ubuntu\projects" }, { "url9": "\wsl$\Ubuntu" }, { "url10": "C:\Users\tony\Github" }, { "url11": "C:\Users\tony\Github\velocity-client-master" }, { "url12": "C:\Users\tony\Github\cogz" }, { "url13": "C:\Users\tony\Github\cogz\cogz" }, { "url14": "Quick access" }, { "url15": "C:\ProgramData\chocolatey\lib\yara\tools" }, { "url16": "C:\Training\MT01\exercise" } ] } }

Looks great! Can you add this as a test? Here is an example.

andreisss commented 2 years ago

Should be ok, first type use this platform, sorry.

mkorman90 commented 2 years ago

@andreisss

Should be ok, first type use this platform, sorry.

https://github.com/mkorman90/regipy/actions/runs/3474264892/jobs/5943199839 Can you please fix the test? Then we can merge

andreisss commented 2 years ago

image localhost test