/// <summary>
/// Read the WinXP Shim Cache data. Some entries can be missing data but still contain useful information, so try to get as much as we can.
/// </summary>
/// <param name="data"></param>
/// <returns></returns>
private static List <Hit> ReadWinXpEntries(byte[] data)
{
List <Hit> hits = new List <Hit>();
UInt32 numEntries = BitConverter.ToUInt32(data.Slice(8, 12), 0);
if (numEntries == 0)
{
return(hits);
}
for (UInt32 index = Global.WINXP_HEADER_SIZE32; index < (numEntries * Global.WINXP_ENTRY_SIZE32); index += Global.WINXP_ENTRY_SIZE32)
{
byte[] temp = data.Slice(index, (index + Global.WINXP_ENTRY_SIZE32));
CacheEntryXp ce = new CacheEntryXp();
ce.Update(temp);
hits.Add(new Hit(Global.CacheType.CacheEntryXp, ce.ModDateTime, ce.ExecDateTime, ce.Path, ce.FileSize, "N/A"));
}
return(hits);
}
/// <summary>
/// Read the WinXP Shim Cache data. Some entries can be missing data but still contain useful information, so try to get as much as we can.
/// </summary>
/// <param name="data"></param>
/// <returns></returns>
private static List<Hit> ReadWinXpEntries(byte[] data)
{
List<Hit> hits = new List<Hit>();
UInt32 numEntries = BitConverter.ToUInt32(data.Slice(8, 12), 0);
if (numEntries == 0)
{
return hits;
}
for (UInt32 index = Global.WINXP_HEADER_SIZE32; index < (numEntries * Global.WINXP_ENTRY_SIZE32); index += Global.WINXP_ENTRY_SIZE32)
{
byte[] temp = data.Slice(index, (index + Global.WINXP_ENTRY_SIZE32));
CacheEntryXp ce = new CacheEntryXp();
ce.Update(temp);
hits.Add(new Hit(Global.CacheType.CacheEntryXp, ce.ModDateTime, ce.ExecDateTime, ce.Path, ce.FileSize, "N/A"));
}
return hits;
}
