EnScript - Registry - EnCase 7

Kwilley · 2014-05-06T03:36:47Z

Hi All,I am really rather new to this whole EnScript work and have been looking to move from EnCase v6 to v7. Using the EnScript SDK that was provided I have been able to create a script that reads data values from select files - using UserAssist keys for this. Now I have moved onto using the SDK example for reading from the registry directly and having issues, running this against an open evidence case I am getting the error of "Cannot open registry" this is both when the item has not been selected and when it has. I have also tried changing the registry class to read from HKEY HIVES instead and then getting an error reading the key. I am looking simple for a way to get this code functioning for a Windows 7 Image. class MainClass { void RunRegistry(CaseClass c, EntryClass e) { RegistryClass reg(e); RegCommandClass cmds(); new RegCommandClass(cmds, "Command Two", RegCommandClassREADKEY, RegCommandClassHKEY_CURRENT_USER, "", "", 0, 2); RegValueClass values(); if (reg.Run(cmds, values)) { BookmarkClass folder(c.BookmarkRoot(), "Reg", NodeClassFOLDER); BookmarkDataClass newData(folder); newData.SetRoot(values); } } void Main(CaseClass c) { if (c) { for(ItemIteratorClass iter(c); EntryClass e=iter.GetNextEntry();) { if (e.Name() == "C") { Console.WriteLine("Registry On " + e.Name()); RunRegistry(c, e); break; } } } else Console.WriteLine("Need An Open Case"); } } I am really rather stumped on how this is suppose to work and an explanation as to how to alter it would be ideal. Kindest Regards,K-