pub fn parse(hive: &Hive<Cursor<Vec<u8>>>) -> Vec<AmcacheEntry>Expand description
Extract all execution entries from an Amcache hive, across BOTH the modern
(Root\InventoryApplicationFile) and legacy (Root\File\{VolumeGUID})
schemas. A real hive carries one or the other; decoding both means the
caller surfaces execution evidence regardless of the host’s Windows version.
Missing values produce empty strings or zero rather than errors. Returns an
empty Vec when neither container key is present.