/// <summary> /// Read the WinXP Shim Cache data. Some entries can be missing data but still contain useful information, so try to get as much as we can. /// </summary> /// <param name="data"></param> /// <returns></returns> private static List <Hit> ReadWinXpEntries(byte[] data) { List <Hit> hits = new List <Hit>(); UInt32 numEntries = BitConverter.ToUInt32(data.Slice(8, 12), 0); if (numEntries == 0) { return(hits); } for (UInt32 index = Global.WINXP_HEADER_SIZE32; index < (numEntries * Global.WINXP_ENTRY_SIZE32); index += Global.WINXP_ENTRY_SIZE32) { byte[] temp = data.Slice(index, (index + Global.WINXP_ENTRY_SIZE32)); CacheEntryXp ce = new CacheEntryXp(); ce.Update(temp); hits.Add(new Hit(Global.CacheType.CacheEntryXp, ce.ModDateTime, ce.ExecDateTime, ce.Path, ce.FileSize, "N/A")); } return(hits); }
/// <summary> /// Read the WinXP Shim Cache data. Some entries can be missing data but still contain useful information, so try to get as much as we can. /// </summary> /// <param name="data"></param> /// <returns></returns> private static List<Hit> ReadWinXpEntries(byte[] data) { List<Hit> hits = new List<Hit>(); UInt32 numEntries = BitConverter.ToUInt32(data.Slice(8, 12), 0); if (numEntries == 0) { return hits; } for (UInt32 index = Global.WINXP_HEADER_SIZE32; index < (numEntries * Global.WINXP_ENTRY_SIZE32); index += Global.WINXP_ENTRY_SIZE32) { byte[] temp = data.Slice(index, (index + Global.WINXP_ENTRY_SIZE32)); CacheEntryXp ce = new CacheEntryXp(); ce.Update(temp); hits.Add(new Hit(Global.CacheType.CacheEntryXp, ce.ModDateTime, ce.ExecDateTime, ce.Path, ce.FileSize, "N/A")); } return hits; }