/*public static ForensicTimeline Get(PSObject input)
{
switch (input.TypeNames[0])
{
case "PowerForensics.Artifacts.Amcache":
break;
case "PowerForensics.Artifacts.Prefetch":
//return Get(input.BaseObject as Prefetch);
break;
case "PowerForensics.Artifacts.ScheduledJob":
return Get(input.BaseObject as ScheduledJob);
break;
case "PowerForensics.Artifacts.UserAssist":
return Get(input.BaseObject as UserAssist);
break;
case "PowerForensics.Artifacts.ShellLink":
//return Get(input.BaseObject as ShellLink);
break;
case "PowerForensics.Ntfs.FileRecord":
try
{
//return Get(input.BaseObject as FileRecord);
}
catch
{
}
break;
case "PowerForensics.Ntfs.UsnJrnl":
return Get(input.BaseObject as UsnJrnl);
break;
case "PowerForensics.EventLog.EventRecord":
return Get(input.BaseObject as EventRecord);
break;
case "PowerForensics.Registry.NamedKey":
return Get(input.BaseObject as NamedKey);
break;
default:
Console.WriteLine(input.TypeNames[0]);
break;
}
}*/
public static ForensicTimeline Get(Amcache input)
{
return null;
}
public static ForensicTimeline[] GetInstances(Amcache[] input)
{
List<ForensicTimeline> list = new List<ForensicTimeline>();
foreach (Amcache a in input)
{
list.Add(Get(a));
}
return list.ToArray();
}