public void DeletedFindTest()
{
var f = @"D:\Sync\RegistryHives\NTUSER.DAT";
var r = new RegistryHive(f);
r.RecoverDeleted = true;
r.ParseHive();
var ts = "2014-12-08 13:39:33 +00:00";
var td = DateTimeOffset.Parse(ts);
var t = r.GetDeletedKey(@"Software\Microsoft\VisualStudio\12.0_Config\Debugger", td.ToString());
Check.That(t).IsNotNull();
Check.That(t.NkRecord.IsDeleted).IsTrue();
}
public void LockedFileTest()
{
var f = @"C:\Windows\appcompat\Programs\Amcache.hve";
var r = new RegistryHive(f);
r.RecoverDeleted = true;
r.ParseHive();
var ts = "2014-12-08 13:39:33 +00:00";
var td = DateTimeOffset.Parse(ts);
var t = r.GetDeletedKey(@"Software\Microsoft\VisualStudio\12.0_Config\Debugger", td.ToString());
Check.That(t).IsNotNull();
Check.That(t.NkRecord.IsDeleted).IsTrue();
}
public void ReallocTest()
{
var f = @"D:\SynologyDrive\Registry\ReallocValueDataHive";
var r = new RegistryHive(f);
r.RecoverDeleted = true;
r.ParseHive();
var ts = "2017-09-10 21:47:31 +00:00";
var td = DateTimeOffset.Parse(ts);
var t = r.GetDeletedKey(@"2", td.ToString());
Check.That(t).IsNotNull();
Check.That(t.NkRecord.IsDeleted).IsTrue();
Check.That(t.Values[0].VkRecord.DataRecordAllocated).IsEqualTo(true);
// Check.That(t.Values[0].ValueData).IsNotEqualTo("1111");
}