SBECmd: Output filenames from SBECmd lack usernames on Linux

[liontruck]

When I run SBECmd on a Linux system, the output CSV filenames do not contain the usernames as expected. Instead, the files are named using numeric prefixes or just the hive type (0_NTUSER.csv, UsrClass.csv, etc.).

For example, I mounted a Windows image at /mnt/windows_mount and ran the following command:

truck@siftworkstation:~$ dotnet ./SBECmd.dll -d /mnt/windows_mount --csv ~/sbecmd-output/
SBECmd version 2.1.0.0

truck@siftworkstation:~$ ls -al ~/sbecmd-output/
total 64
drwxrwxr-x  2 truck truck  4096 May 15 14:01  .
drwxr-xr-x 27 truck truck  4096 May 15 14:00  ..
-rw-rw-r--  1 truck truck   227 May 15 14:01  0_NTUSER.csv
-rw-rw-r--  1 truck truck  1871 May 15 14:01  0_UsrClass.csv
-rw-rw-r--  1 truck truck   227 May 15 14:01  1_NTUSER.csv
-rw-rw-r--  1 truck truck  9110 May 15 14:01  1_UsrClass.csv
-rw-rw-r--  1 truck truck  5069 May 15 14:01  2_UsrClass.csv
-rw-rw-r--  1 truck truck   227 May 15 14:01  NTUSER.csv
-rw-rw-r--  1 truck truck 12325 May 15 14:01 '!SBECmd_Messages.txt'
-rw-rw-r--  1 truck truck   369 May 15 14:01  UsrClass.csv

!SBECmd_Messages.txt file shows SBECmd correctly identifies different user hives during processing:

[14:01:56.432 INF] Finished processing /mnt/windows_mount/Users/Administrator/NTUSER.DAT
[14:01:56.432 INF] Exported to: /home/truck/sbecmd-output/NTUSER.csv

Questions:

• Is this the expected behavior on Linux or am I doing something wrong? Should the output filenames include the username (like Administrator_NTUSER.csv) if available?
• If this is expected behavior, is there a way to include the source file path (/mnt/windows_mount/Users/Administrator/NTUSER.DAT) as a column within each CSV for context?

Thanks in advanced.

[EricZimmerman]

expected? no, but i dont use it that way on linux.

you could always run it on windows =)

adding the full path to the csv changes TLE and many other things, so that is less desirable.

as is, youd have to look at the console messages to see which hive ended up with which final name. i can try to make it work on linux

if you wanted to do a PR thats cool. else ill see what i can do when i get a chance

[reece394]

Unfortunately SBECmd is not Open Source like the rest of the tools however I believe I have traced the issue to the following code:

private static void ProcessOfflineHive(
.....
    string str1 = string.Empty;
    try
    {
      for (Match match = new Regex("users\\\\(.+?)\\\\", RegexOptions.IgnoreCase).Match(fname); match.Success; match = match.NextMatch())
      {
        str1 = Path.GetFileName(match.Groups[1].Value);
        str1 += "_";
      }
    }
    catch (ArgumentException ex)
    {
    }

The issue is that it only takes into consideration Windows-style backslashes. The code will need changed to also take in mind forward slashes like my code changes here EricZimmerman/WxTCmd#12. Feel free @EricZimmerman to utilise it to fix this issue as well. It won't be an exact match as this tool doesn't seem to have the issue of multiple user folders like WxTCmd during testing. Probably only need to do the forward and backslash handling bits of the regex. (Would do it for you but I know you have your reasons not to open source this)

[EricZimmerman]

When I saw your last or I thought of this too