Skip to content

Get-ForensicAmcache returns an error #169

@Edelwy

Description

@Edelwy

When I'm trying to run Get-ForensicAmcache it returns an error:

Get-ForensicAmcache : Cannot find key 'Root\File' in the 'C:\Windows\appcompat\Programs\Amcache.hve' hive because it does not exist.
At line:1 char:1

  • Get-ForensicAmcache -HivePath C:\Windows\appcompat\Programs\Amcache.h ...
  •   + CategoryInfo          : NotSpecified: (:) [Get-ForensicAmcache], Exception
      + FullyQualifiedErrorId : System.Exception,PowerForensics.Cmdlets.GetAmcacheCommand
    
    

Am I doing something wrong?
The path for Amcache.hve is correct.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions