private IEnumerable <ValuesOut> ProcessKey(RegistryKey key)
{
var l = new List <ValuesOut>();
foreach (var subKey in key.SubKeys)
{
if (subKey.SubKeys.Count == 0)
{
continue;
}
try
{
string[] words = subKey.KeyName.Split('&');
if (words.Length != 4)
{
continue;
}
string Manufacture = words[1];
string Title = words[2];
string Version = words[3];
var serialSubKey = subKey.SubKeys.First();
string serialNumber = serialSubKey.KeyName;
string deviceName = Encoding.Unicode?.GetString(
GetData(serialSubKey, GUIDs[0], "0004")
);
DateTimeOffset?installed = GetUTC(
GetData(serialSubKey, GUIDs[1], "0064")
);
DateTimeOffset?firstInstalled = GetUTC(
GetData(serialSubKey, GUIDs[1], "0065")
);
DateTimeOffset?lastConnected = GetUTC(
GetData(serialSubKey, GUIDs[1], "0066")
);
DateTimeOffset?lastRemoved = GetUTC(
GetData(serialSubKey, GUIDs[1], "0067")
);
DateTimeOffset?ts = subKey.LastWriteTime;
var ff = new ValuesOut(Manufacture, Title, Version, serialNumber, ts,
deviceName, installed, firstInstalled, lastConnected, lastRemoved)
{
BatchValueName = "Multiple",
BatchKeyPath = subKey.KeyPath
};
l.Add(ff);
}
catch (Exception ex)
{
Errors.Add($"Error processing USBSTOR key: {ex.Message}");
}
}
if (Errors.Count > 0)
{
AlertMessage = "Errors detected. See Errors information in lower right corner of plugin window";
}
return(l);
}
private IEnumerable <ValuesOut> ProcessKey(RegistryKey key)
{
var l = new List <ValuesOut>();
foreach (var subKey in key.SubKeys)
{
if (subKey.SubKeys.Count == 0)
{
continue;
}
try
{
var words = subKey.KeyName.Split('&');
if (words.Length != 4)
{
continue;
}
var Manufacturer = words[1];
var Title = words[2];
var Version = words[3];
foreach (var serialSubKey in subKey.SubKeys)
{
var serialNumber = serialSubKey.KeyName;
var deviceName = Encoding.Unicode?.GetString(
GetData(serialSubKey, GUIDs[0], "0004")
);
var installed = GetUTC(
GetData(serialSubKey, GUIDs[1], "0064")
);
var firstInstalled = GetUTC(
GetData(serialSubKey, GUIDs[1], "0065")
);
var lastConnected = GetUTC(
GetData(serialSubKey, GUIDs[1], "0066")
);
var lastRemoved = GetUTC(
GetData(serialSubKey, GUIDs[1], "0067")
);
var ts = subKey.LastWriteTime;
var deviceParametersKey = subKey.SubKeys.First().SubKeys.SingleOrDefault(t => t.KeyName == "Device Parameters");
var diskId = "";
if (deviceParametersKey != null)
{
var aaaa = deviceParametersKey.SubKeys.SingleOrDefault(t => t.KeyName == "Partmgr");
if (aaaa != null)
{
var ddd = aaaa.Values.SingleOrDefault(t => t.ValueName == "DiskId");
if (ddd != null)
{
diskId = ddd.ValueData;
}
}
}
var ff = new ValuesOut(ts, Manufacturer, Title, Version, serialNumber,
deviceName, installed, firstInstalled, lastConnected, lastRemoved, diskId)
{
BatchValueName = "Multiple",
BatchKeyPath = subKey.KeyPath
};
l.Add(ff);
}
}
catch (Exception ex)
{
Errors.Add($"Error processing USBSTOR key: {ex.Message}");
}
}
if (Errors.Count > 0)
{
AlertMessage = "Errors detected. See Errors information in lower right corner of plugin window";
}
return(l);
}
