-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
Used RegRipper v2.8 with comdlg32 v20121008 plugin to parse an ntuser.dat file
from a Win 7 machine. The resulting report for the OpenSavePidMRU\*, \docx,
\jpg and \pdf entries contained files described as "Libraries" but the other
files were properly listed. When I viewed the key using registry viewer, those
files labeled in the regripper output as "Libraries" were found to actually be
listed as follows:
For OpenSavePidMRU\*:
C:\Users\<user>\Pictures\images1.jpg
C:\Users\<user>\Pictures\images2.jpg
C:\Users\<user>\Pictures\images3.jpg
C:\Users\<user>\Documents\doc1.docx
C:\Users\<user>\Documents\images4.jpg
For OpenSavePidMRU\docx:
IT_Resume.docx
C:\Users\<user>\Documents\doc1.docx
C:\Users\<user>\Documents\doc2.docx
For: OpenSavePidMRU\jpg:
C:\Users\<user>\Documents\images4.jpg
C:\Users\<user>\Pictures\images3.jpg
C:\Users\<user>\Pictures\images2.jpg
C:\Users\<user>\Pictures\images1.jpg
C:\Users\<user>\Pictures\imagesA.jpg
C:\Users\<user>\Pictures\imagesB.jpg
C:\Users\<user>\Pictures\imagesC.jpg
C:\Users\<user>\Pictures\imagesD.jpg
C:\Users\<user>\Pictures\imagesE.jpg
For: OpenSavePidMRU\pdf:
C:\Users\<user>\Desktop\pdffile1.pdf
Why does regripper report the above files and file paths simply as "Libraries"?
Original issue reported on code.google.com by mgodf...@gmail.com on 28 Jun 2013 at 3:37
Reactions are currently unavailable