Skip to main content

parse

Function parse 

Source
pub fn parse(hive: &Hive<Cursor<Vec<u8>>>) -> Vec<AmcacheEntry>
Expand description

Extract all InventoryApplicationFile entries from an Amcache hive.

Navigates Root\InventoryApplicationFile, iterates each subkey, and extracts the forensically relevant values. Missing values produce empty strings or zero rather than errors.

Returns an empty Vec if the key is not present.