public static RecentDocs[] Get(string hivePath) { if (RegistryHelper.isCorrectHive(hivePath, "NTUSER.DAT")) { string user = RegistryHelper.GetUserHiveOwner(hivePath); byte[] bytes = RegistryHelper.GetHiveBytes(hivePath); string key = @"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"; NamedKey RecentDocsKey = NamedKey.Get(bytes, hivePath, @"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"); ValueKey MRUListEx = ValueKey.Get(bytes, hivePath, key, "MRUListEx"); byte[] MRUListBytes = (byte[])MRUListEx.GetData(bytes); RecentDocs[] docs = new RecentDocs[MRUListBytes.Length / 4]; for (int i = 0; i < MRUListBytes.Length - 4; i += 4) { if (i == 0) { docs[i / 4] = new RecentDocs(user, Encoding.Unicode.GetString((byte[])ValueKey.Get(bytes, hivePath, key, BitConverter.ToInt32(MRUListBytes, i).ToString()).GetData(bytes)).Split('\0')[0], RecentDocsKey.WriteTime); } else { docs[i / 4] = new RecentDocs(user, Encoding.Unicode.GetString((byte[])ValueKey.Get(bytes, hivePath, key, BitConverter.ToInt32(MRUListBytes, i).ToString()).GetData(bytes)).Split('\0')[0]); } } return(docs); } else { throw new Exception("Invalid NTUSER.DAT hive provided to the -HivePath parameter."); } }
public static RecentDocs[] Get(string hivePath) { if (RegistryHelper.isCorrectHive(hivePath, "NTUSER.DAT")) { string user = RegistryHelper.GetUserHiveOwner(hivePath); byte[] bytes = RegistryHelper.GetHiveBytes(hivePath); string key = @"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"; NamedKey RecentDocsKey = NamedKey.Get(bytes, hivePath, @"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"); ValueKey MRUListEx = ValueKey.Get(bytes, hivePath, key, "MRUListEx"); byte[] MRUListBytes = (byte[])MRUListEx.GetData(bytes); RecentDocs[] docs = new RecentDocs[MRUListBytes.Length / 4]; for (int i = 0; i < MRUListBytes.Length - 4; i += 4) { if(i == 0) { docs[i / 4] = new RecentDocs(user, Encoding.Unicode.GetString((byte[])ValueKey.Get(bytes, hivePath, key, BitConverter.ToInt32(MRUListBytes, i).ToString()).GetData(bytes)).Split('\0')[0], RecentDocsKey.WriteTime); } else { docs[i / 4] = new RecentDocs(user, Encoding.Unicode.GetString((byte[])ValueKey.Get(bytes, hivePath, key, BitConverter.ToInt32(MRUListBytes, i).ToString()).GetData(bytes)).Split('\0')[0]); } } return docs; } else { throw new Exception("Invalid NTUSER.DAT hive provided to the -HivePath parameter."); } }