reece394
reece394
I finally got a chance to test this out with RECmd. I noticed a few issues with the plugin when using it on a batch file. I implemented DateTime.Ticks support...
@AndrewRathbun I think I traced this to BatchDumpKey ```c# if (key.DisablePlugin == false && pluginsToActivate.Count > 0) ``` Reading the code it seems to process anything that the plugin specifies...
Pushed up an alternative pull request there that puts the code into the Registry library directly. Offers better compatibility with RECmd than a plugin but haven't implemented the date parsing...
Sounds good to me. I feel like we have a good compromise. This plugin should be used in Registry Explorer as it additionally parses the per value timestamps and we...
Funny enough there is the DisablePlugin: true line if you look above that works well too
Thanks for tracing this issue! Interesting that there is a quirk with the ShellItems.
I will look into adjusting this when I get a chance. Also I know when running KAPE and the RECmd_DFIRBatch.mkape it doesn't actually display console output or log it to...
Changed based on feedback to use nl true instead. Modified the description of the nl flag as well to clarify the behaviour change
Exactly yes. I figure something in this case is better than nothing
Rebased on latest changes as of 23/03/2025