** RECmd version # **
I am using RLA 2.1.0+f2bb2cd16541ef739d4bdba8807396c5b26e3df0.
Describe the bug
I downloaded new version of RLA, and it does not recreate directories anymore. Old version I was using before (2.0.0.0+4306f0532b7cbb356027d05f2bb62f93f7864e2e) recreated directories with --nop False, but updated version does not. Instead, the whole path is in the name of the file, where folders are separated by underscore (i.e. C_triage_Windows_system32_config_SAM).
The commadline I am using is rla.exe -d C:\triage --nop False --cn False --out C:\out.
Same thing happens with --cn True, only user registers start with user folder (_user_NTUSER.DAT).
There is also another behaviour which may be unintentional. When using --nop True --cn False on source with multiple users, it looks like RLA tries to save non-compressed name when detecting existing file with same name in output directory, but saves file with the same name, thus rewriting original file as seen in screenshot. This results in loss of files in output directory.
But this could also be normal behaviour, because with --nop True there is no path in filename.
To Reproduce
Steps to reproduce the behavior:
- Create triage which contains registers with Kape
- Use RLA on the triage with command
rla.exe -d C:\triage --nop False --cn False --out C:\out
- Open output directory to see there are no subdirectories.
Expected behavior
Using --nop False (or not using this argument as it is default value) would recerate folder structure in output directory. Using --nop False --cn False would probably recreate folder structure, but starting from user folder on user registers. I could not test this on old version of RLA, because it threw IndexOutOfRangeException exception.
Screenshots
** RECmd version # **
I am using RLA 2.1.0+f2bb2cd16541ef739d4bdba8807396c5b26e3df0.
Describe the bug
I downloaded new version of RLA, and it does not recreate directories anymore. Old version I was using before (2.0.0.0+4306f0532b7cbb356027d05f2bb62f93f7864e2e) recreated directories with
--nop False, but updated version does not. Instead, the whole path is in the name of the file, where folders are separated by underscore (i.e. C_triage_Windows_system32_config_SAM).The commadline I am using is
rla.exe -d C:\triage --nop False --cn False --out C:\out.Same thing happens with
--cn True, only user registers start with user folder (_user_NTUSER.DAT).There is also another behaviour which may be unintentional. When using
--nop True --cn Falseon source with multiple users, it looks like RLA tries to save non-compressed name when detecting existing file with same name in output directory, but saves file with the same name, thus rewriting original file as seen in screenshot. This results in loss of files in output directory.But this could also be normal behaviour, because with --nop True there is no path in filename.
To Reproduce
Steps to reproduce the behavior:
rla.exe -d C:\triage --nop False --cn False --out C:\outExpected behavior
Using
--nop False(or not using this argument as it is default value) would recerate folder structure in output directory. Using--nop False --cn Falsewould probably recreate folder structure, but starting from user folder on user registers. I could not test this on old version of RLA, because it threw IndexOutOfRangeException exception.Screenshots