Get-ForensicAmcache returns error

[nremezov]

When I'm trying to run Get-ForensicAmcache it returns frollowing error:

PS C:\Windows\system32> Get-ForensicAmcache -HivePath C:\Windows\AppCompat\Programs\Amcache.hve

Get-ForensicAmcache : Index and count must refer to a location within the buffer.
Parameter name: bytes
At line:1 char:1

• Get-ForensicAmcache -HivePath C:\Windows\AppCompat\Programs\Amcache.hve

• - CategoryInfo          : NotSpecified: (:) [Get-ForensicAmcache], ArgumentOutOfRangeException
  - FullyQualifiedErrorId : System.ArgumentOutOfRangeException,PowerForensics.Cmdlets.GetAmcacheCommand
  

[jaredcatkinson]

Thanks for reporting this bug. I will take a look at it in the morning and hopefully have a fix up soon.

[nremezov]

PS C:\Windows\system32> $stacktrace
at System.Text.ASCIIEncoding.GetString(Byte[] bytes, Int32 byteIndex, Int32 byteCount)
at PowerForensics.Registry.NamedKey..ctor(Byte[] bytes, String hivePath, String key) in C:\Users\tester\Documents\Gi
tHub\PowerForensics\PowerForensics\src\Windows\Registry\Cells\NamedKey.cs:line 56
at PowerForensics.Registry.NamedKey.GetSubKeys(Byte[] bytes, String key) in C:\Users\tester\Documents\GitHub\PowerFo
rensics\PowerForensics\src\Windows\Registry\Cells\NamedKey.cs:line 264
at PowerForensics.Artifacts.Amcache.GetInstancesByPath(String hivePath) in C:\Users\tester\Documents\GitHub\PowerFor
ensics\PowerForensics\src\Artifacts\Amcache.cs:line 101
at PowerForensics.Cmdlets.GetAmcacheCommand.ProcessRecord() in C:\Users\tester\Documents\GitHub\PowerForensics\Power
Forensics\src\Cmdlets\Artifacts\Get-Amcache.cs:line 68
at System.Management.Automation.CommandProcessor.ProcessRecord()

[jaredcatkinson]

I think this should be fixed in https://github.com/Invoke-IR/PowerForensics/releases/tag/1.1.1

[davehull]

@jaredcatkinson We're seeing the same error on a Win7 system using Get-ForensicPrefetch -Fast -Volumename C:
Any thoughts about whether this may be related or is fixed in a more recent version?

[davehull]

@jaredcatkinson After further investigation on the affected Win7 system, we found a .pf file in \Windows\Prefetch that was 0 length. Can you add a check for file size and skip 0 length files? I've never seen a 0 length .pf before, no idea how it got there.