EnScript - Registry - EnCase 7

Kwilley · 2014-05-06T03:36:47Z

Hi All,I am really rather new to this whole EnScript work and have been looking to move from EnCase v6 to v7. Using the EnScript SDK that was provided I have been able to create a script that reads data values from select files - using UserAssist keys for this. Now I have moved onto using the SDK example for reading from the registry directly and having issues, running this against an open evidence case I am getting the error of "Cannot open registry" this is both when the item has not been selected and when it has. I have also tried changing the registry class to read from HKEY HIVES instead and then getting an error reading the key. I am looking simple for a way to get this code functioning for a Windows 7 Image. class MainClass { void RunRegistry(CaseClass c, EntryClass e) { RegistryClass reg(e); RegCommandClass cmds(); new RegCommandClass(cmds, "Command Two", RegCommandClassREADKEY, RegCommandClassHKEY_CURRENT_USER, "", "", 0, 2); RegValueClass values(); if (reg.Run(cmds, values)) { BookmarkClass folder(c.BookmarkRoot(), "Reg", NodeClassFOLDER); BookmarkDataClass newData(folder); newData.SetRoot(values); } } void Main(CaseClass c) { if (c) { for(ItemIteratorClass iter(c); EntryClass e=iter.GetNextEntry();) { if (e.Name() == "C") { Console.WriteLine("Registry On " + e.Name()); RunRegistry(c, e); break; } } } else Console.WriteLine("Need An Open Case"); } } I am really rather stumped on how this is suppose to work and an explanation as to how to alter it would be ideal. Kindest Regards,K-

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by WMIF 11 years ago

11 Posts

4 Users

0 Reactions

3,590 Views

RSS

WMIF

(@wmif)

Active Member

Joined: 14 years ago

Posts: 7

13/05/2014 1:25 am

Glad to help. Let me know if I can answer any more questions.

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
278 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed