Hi all,
I'm porting code from EncaseV6.19 toV7.04.01. i've got code to bookmark regitry files for a user. It compiles& runs under V6, but under 7 it generates an "BookmarkFolderClass" is an unknown identifier,error. I dont see bookmark folderclass in the V7class browser. Has it been replaced?hidden? I've included the code below(Do I have other options? Thanks in advance for our attention and help.
Todd Julius
Leahy Center for Digital Investigation
Burlington vt
[note I originally cribbed this code and idea from lance mueller example.]
class MainClass
{
void Main(CaseClass c)
{
SystemClassClearConsole(1);
BookmarkFolderClass Win8registryfolder;
BookmarkFolderClass Win8IndexFolder;
Win8registryfolder=new BookmarkFolderClass(c.BookmarkRoot(),"Win8_Registry_Files");
forall (EntryClass entry in c.EntryRoot()) //loop through each case file(each entry)
{
//
if (entry.Name().SubString(0,6)=="NTUSER"&&entry.Extension()=="DAT") //if egistry file
Win8registryfolder.AddBookmark(entry,0,entry.LogicalSize(),entry.Name(), //add to registry folder
BookmarkClassSHOWREPORT, BookmarkClassLOWASCII);
} //end If NTUSER
} // end for all entry
}// end main function
} // end main
This should work for you in v7.
class MainClass {
void Main(CaseClass c) {
BookmarkClass Win8registryfolder(c.BookmarkRoot(), "Win8_Registry_Files", NodeClassFOLDER);
for (ItemIteratorClass iter(c); EntryClass entry = iter.GetNextEntry();) {
if (entry.Name().SubString(0,6)=="NTUSER"&&entry.Extension()=="DAT") //if egistry file
BookmarkItemClass bic(Win8registryfolder, entry.Name(), 0);
}
}
}
It works. I'm off and running-Thanks Lance!