AmcacheParser ignores "old format" entries if "new format" entries are found

[msuhanov]

Hello.

Here is the output of your tool:

AmcacheParser version 1.5.1.0

Author: Eric Zimmerman ([email protected])
https://github.com/EricZimmerman/AmcacheParser

Command line: -f Amcache.hve --csv .

Warning: Administrator privileges not found!

Error parsing ProgramsEntry at {11517B7C-E79D-4e20-961B-75A811715ADD}\Root\InventoryApplication\0000f3a1ae240ab0d68d8f4673f7bc63c42c00000904. Error: Строка не распознана как действительное значение DateTime.

[...]

C:\Users\MS\Desktop\amcache\Amcache.hve is in new format!

Total file entries found: 486
Total device containers found: 141
Total device PnPs found: 105
Total drive binaries found: 284
Total driver packages found: 16

Found 18 unassociated file entry

Results saved to: .

Total parsing time: 1,323 seconds

Here is a key that isn't parsed by your tool:

Key path: Root\File\dd31621c-4f8f-11e4-9f49-806e6f6e6963\1000004513b
Last written timestamp (UTC): 2020-07-29 16:59:41.147582
Access bits: 0
Owner SID: S-1-5-32-544

[...]

Value name: 15
Value type: REG_SZ
Data size: 112
Data (decoded):
c:\program files (x86)\opera\69.0.3686.77\installer.exe^@

[...]

---

("^@" marks the null byte.)

So, the Amcache hive contains entries having both the new and old formats. Those using the old format aren't parsed (e.g., the path quoted above is missing in the CSV files).

Unfortunately, I can't share the hive file.

[EricZimmerman]

hmm, an odd fringe case. ill see if i can add a switch to force which one to parse. that should do it.