public void ShouldFind4HitsForBingXInKeyNamesWithRegEx()
{
var usrClass1 = new RegistryHive(@"..\..\..\Hives\UsrClass 1.dat");
usrClass1.RecoverDeleted = true;
usrClass1.FlushRecordListsAfterParse = false;
usrClass1.ParseHive();
var hits = usrClass1.FindInKeyName("Microsoft.Bing[FHW]", true).ToList();
Check.That(hits.Count).IsEqualTo(44);
hits = usrClass1.FindInKeyName("Microsoft.Bing[FHW]o", true).ToList();
Check.That(hits.Count).IsEqualTo(11);
}
public void ShouldFindThreeHitsForMuiCacheInKeyName()
{
var usrClass1 = new RegistryHive(@"..\..\..\Hives\UsrClass 1.dat");
usrClass1.RecoverDeleted = true;
usrClass1.FlushRecordListsAfterParse = false;
usrClass1.ParseHive();
var hits = usrClass1.FindInKeyName("MuiCache").ToList();
Check.That(hits.Count).IsEqualTo(3);
}
public void ShouldFindNoHitsForZimmermanInKeyName()
{
var usrClass1 = new RegistryHive(@".\Hives\UsrClass 1.dat");
usrClass1.RecoverDeleted = true;
usrClass1.FlushRecordListsAfterParse = false;
usrClass1.ParseHive();
var hits = usrClass1.FindInKeyName("Zimmerman").ToList();
Check.That(hits.Count).IsEqualTo(0);
}
public void ShouldFind100HitsForUrlInKeyAndValueName()
{
var usrClass1 = new RegistryHive(@"..\..\..\Hives\UsrClass 1.dat");
usrClass1.RecoverDeleted = true;
usrClass1.FlushRecordListsAfterParse = false;
usrClass1.ParseHive();
var keyHits = usrClass1.FindInKeyName("URL").ToList();
Check.That(keyHits.Count).IsEqualTo(21);
var valHits = usrClass1.FindInValueName("URL").ToList();
Check.That(valHits.Count).IsEqualTo(79);
}