RECmd icon indicating copy to clipboard operation
RECmd copied to clipboard

RLA

Open gunner4361 opened this issue 1 year ago • 2 comments

Command line: -d D:\test\DESKTOP-1\uploads\auto\C\Users\b --out D:\test\DESKTOP-1\uploads\auto\C\Users\b\t

    Hives found: 2
Processing hive D:\test\DESKTOP-1\uploads\auto\C\Users\b\NTUSER.DAT
Two transaction logs found. Determining primary log...
Primary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG2, secondary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG1
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG2
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\ntuser.dat.LOG1
At least one transaction log was applied. Sequence numbers have been updated to 0x100A12. New Checksum: 0xAF344325
There was an error: Index was outside the bounds of the array.
System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at rla.Program.DoWork(String f, String d, String out, Boolean ca, Boolean cn, Boolean debug, Boolean trace)

Processing hive D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat
Two transaction logs found. Determining primary log...
Primary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2, secondary log: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
Replaying log file: D:\test\DESKTOP-1\uploads\auto\C\Users\b\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
At least one transaction log was applied. Sequence numbers have been updated to 0x2C393. New Checksum: 0x449B1856
There was an error: Index was outside the bounds of the array.
System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at rla.Program.DoWork(String f, String d, String out, Boolean ca, Boolean cn, Boolean debug, Boolean trace)

gunner4361 avatar Jan 15 '24 06:01 gunner4361

What version of RLA were you using?

AndrewRathbun avatar Jan 15 '24 13:01 AndrewRathbun

I have a fix for registry that may be related that involves transaction log size.

Let us know the version of rla tho and if you can share those files that cause this.

EricZimmerman avatar Jan 15 '24 13:01 EricZimmerman

No hives. Nothing to do.

EricZimmerman avatar Jun 25 '24 02:06 EricZimmerman