Additional challenges
We talked extensively about the additions that Windows 7 brought to the UserAssist artifact. However, there are even more changes that we did not account for in our current implementation of the UserAssist framework. With Windows 7, some common folder names were replaced with GUIDs. The following is a table of some examples of folders and their respective GUID:
|
Folder |
GUID |
|---|---|
|
UserProfiles |
{0762D272-C50A-4BB0-A382-697DCD729B80} |
|
Desktop |
{B4BFCC3A-DB2C-424C-B029-7FE99A87C641} |
|
Documents |
{FDD39AD0-238F-46AF-ADB4-6C85480369C7} |
|
Downloads |
{374DE290-123F-4565-9164-39C4925E467B} |
An improvement to our script might involve finding these and other common folder GUIDs and replacing them with the true path. A list of some of these ...
Get Learning Python for Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
