Merge pull request #68 from reece394/ParseDirtyHiveNoLog

Change default behaviour of nl true
EricZimmerman · Jan 15, 2025 · 0eac88e · 0eac88e
2 parents 103c406 + 09aec93
commit 0eac88e
Showing 1 changed file with 1 addition and 8 deletions.
diff --git a/RECmd/Program.cs b/RECmd/Program.cs
@@ -237,7 +237,7 @@ private static async Task Main(string[] args)
             new Option<bool>(
                 "--nl",
                 () => false,
-                "When true, ignore transaction log files for dirty hives"),
+                "When true, allow transaction log files to not exist for dirty hives"),
 
             new Option<bool>(
                 "--recover",
@@ -888,8 +888,6 @@ private static void DoWork(string d, string f, string kn, string vn, string bn,
                     }
                     else
                     {
-                        if (nl == false)
-                        {
                             if (rawFiles != null)
                             {
                                 var lt = new List<TransactionLogFileInfo>();
@@ -907,11 +905,6 @@ private static void DoWork(string d, string f, string kn, string vn, string bn,
                             {
                                 reg.ProcessTransactionLogs(logFiles.ToList(), true);
                             }
-                        }
-                        else
-                        {
-                            Log.Warning("Registry hive is dirty and transaction logs were found in the same directory, but --nl was provided. Data may be missing! Continuing anyways...");
-                        }
                     }
                 }