/*public static ForensicTimeline Get(PSObject input) { switch (input.TypeNames[0]) { case "PowerForensics.Artifacts.Amcache": break; case "PowerForensics.Artifacts.Prefetch": //return Get(input.BaseObject as Prefetch); break; case "PowerForensics.Artifacts.ScheduledJob": return Get(input.BaseObject as ScheduledJob); break; case "PowerForensics.Artifacts.UserAssist": return Get(input.BaseObject as UserAssist); break; case "PowerForensics.Artifacts.ShellLink": //return Get(input.BaseObject as ShellLink); break; case "PowerForensics.Ntfs.FileRecord": try { //return Get(input.BaseObject as FileRecord); } catch { } break; case "PowerForensics.Ntfs.UsnJrnl": return Get(input.BaseObject as UsnJrnl); break; case "PowerForensics.EventLog.EventRecord": return Get(input.BaseObject as EventRecord); break; case "PowerForensics.Registry.NamedKey": return Get(input.BaseObject as NamedKey); break; default: Console.WriteLine(input.TypeNames[0]); break; } }*/ public static ForensicTimeline Get(Amcache input) { return null; }
public static ForensicTimeline[] GetInstances(Amcache[] input) { List<ForensicTimeline> list = new List<ForensicTimeline>(); foreach (Amcache a in input) { list.Add(Get(a)); } return list.ToArray(); }