Skip to main content

parse

Function parse 

Source
pub fn parse(hive: &Hive<Cursor<Vec<u8>>>) -> Vec<SamUserEntry>
Expand description

Parse local user accounts from a SAM hive.

Walks SAM\Domains\Account\Users\Names for usernames. For each username finds the corresponding Users\<RID_hex> key and reads its F value to extract timestamps and account flags.