diff --git a/cmd/ffind/main.go b/cmd/ffind/main.go index ddf4bc0..ff9ac8b 100644 --- a/cmd/ffind/main.go +++ b/cmd/ffind/main.go @@ -28,7 +28,7 @@ // The arguments are: // // mount -// The systems root path or image mount point. +// The image mount point(s) or the system root path(s). // Defaults to STDIN, then %SYSTEMDRIVE% if not given. package main diff --git a/cmd/ffind/test.txt b/cmd/ffind/test.txt deleted file mode 100644 index b8e38ce..0000000 --- a/cmd/ffind/test.txt +++ /dev/null @@ -1,309 +0,0 @@ -a8885c03b045e199b326625e4d312a50 /mnt/test/p1/Windows/System32/config/COMPONENTS -2159a105d1aab8fa387379f484b96792 /mnt/test/p1/Windows/System32/config/DEFAULT -811c5b4d97aff9c3ee6030765167b2da /mnt/test/p1/Windows/System32/config/SAM -a0b7c0550abae47ff42f9267bdeb9470 /mnt/test/p1/Windows/System32/config/SECURITY -7226303b22d0d4fb52750d69c8027279 /mnt/test/p1/Windows/System32/config/SOFTWARE -cc916daa51774fa88ac34eac5943769c /mnt/test/p1/Windows/System32/config/SYSTEM -e804e7e480cfa249c5b44508e7b58a11 /mnt/test/p1/Windows/System32/winevt/Logs/Application.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/HardwareEvents.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Internet Explorer.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Key Management Service.evtx -81a7e18b5c877011bd6626ce0afb45dd /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Client-Licensing-Platform%4Admin.evtx -cf63197184aa551d0d4611b73b6cd61b /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AAD%4Operational.evtx -c147a027c3adaec4e86f46e17d9d86f8 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppModel-Runtime%4Admin.evtx -8ea97f4ed42daef4073f07a3fef86e28 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppReadiness%4Admin.evtx -2160407c5d547098192611b662333211 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppReadiness%4Operational.evtx -f4471d23e0ad62ec760bc0a2913cf39b /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppXDeployment%4Operational.evtx -c059657e40be73ef7a706cd7e54c565f /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppXDeploymentServer%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Inventory.evtx -7648256ac8577713dd47392cc69fe438 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx -16862f7e21d8c8a1a69c84d5dbb3c362 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-AppxPackaging%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Audio%4CaptureMonitor.evtx -004c98f8ad9ef4d4399c528a32bcdd7e /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Audio%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Audio%4PlaybackManager.evtx -9b9b74e60cf4f9808c2dc10c7d684784 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Authentication User Interface%4Operational.evtx -0e14ee3df6369ac3e079b09f57821703 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx -fa0fc8d8a593777a78ee596e39f1c0d2 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Biometrics%4Operational.evtx -65631ee64948adceeb9aed66b06f53e4 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker%4BitLocker Management.evtx -57e2470e2ebb5d72337517b32162b421 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Bits-Client%4Operational.evtx -00d451a8483894a44d015345e984ecb7 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-CloudStore%4Operational.evtx -72f6658fceff1309d4c9f81b3c1c2ed7 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-CodeIntegrity%4Operational.evtx -d1b204b076d0cc3181798b11c759aadd /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Containers-BindFlt%4Operational.evtx -61a9f8bdead426454eb2e3aeb22d2b7f /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Containers-Wcifs%4Operational.evtx -93218f86da7cfaa80c7de3055e124e56 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx -6b05d6d38833d9eaef4b1f28e67c8134 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Crypto-DPAPI%4Operational.evtx -c7dfaee3ebf1631e4c341cc4eca4376c /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Crypto-NCrypt%4Operational.evtx -0ba604c388f5ac5e70bdb98f943d0ae1 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx -0104696ec7758fc8e11bd93efca91468 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx -f82d8f952c2231ccb77774461db32732 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-DeviceSetupManager%4Admin.evtx -bdc0eba27a9248317d1fee5f741e12d3 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-DeviceSetupManager%4Operational.evtx -9989c9a4e41b716f6d3a6b7001e66b2c /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Dhcp-Client%4Admin.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Dhcpv6-Client%4Admin.evtx -b1c2d5403263ed87d825b462875ae5b9 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Diagnosis-DPS%4Operational.evtx -24e29d70da531169faa18e67adf39788 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx -b998c80e49e7534710a46b0d0026d630 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Diagnostics-Performance%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-FileHistory-Core%4WHC.evtx -b8021885599acada4c7b657ad70945c5 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-GroupPolicy%4Operational.evtx -ce12ff42c6a0b5e0eda92a6382f74b09 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-HelloForBusiness%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-HotspotAuth%4Operational.evtx -f6c27f0321d865c9a453f108d32cf40a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-Boot%4Operational.evtx -7b0d77b7d5e0ba4db34e5f204e271cc2 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-EventTracing%4Admin.evtx -c0bb57d504ba23b235e2a920b8138207 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Configuration.evtx -da57a1739408d1600c394507393bad7d /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx -c7f1fb1fbfe7ef14709e3c1dca12f12c /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-WHEA%4Errors.evtx -f67785cbe2dd220e5361e751da08c30d /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Kernel-WHEA%4Operational.evtx -ef6e65e2bd00c8717599c2cb94173c3b /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Known Folders API Service.evtx -883ec265dd4c43e530df50dc969a2e96 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-LanguagePackSetup%4Operational.evtx -2e004518aa7b5b46754f9d950e259c2d /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-LiveId%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-MUI%4Admin.evtx -3e76367b30d5c2b4a8bf2894e5734698 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-MUI%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Admin.evtx -961bd7abdd41cff22573a93ce1183396 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Autopilot.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Diagnostics.evtx -ca98a5d3bc6ade9dd2ce4ff713f26794 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4ManagementService.evtx -de6ac44690b8d5c955ff82d64e1d05ad /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-NCSI%4Operational.evtx -ed219d460f330982fcd51b4d141d75d5 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-NetworkProfile%4Operational.evtx -9e96625780199a502a0ee2b3eae12a7f /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Ntfs%4Operational.evtx -14cbbc3d3ec28685b076756b767ab723 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Ntfs%4WHC.evtx -a5f8a96629bcf00eab5f8a4cd672cd24 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Partition%4Diagnostic.evtx -344b05316f3ebeadb5e9a2923f1c3ca2 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Privacy-Auditing%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx -95ed8d237a1a10e64bd2903d821f8a33 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Provisioning-Diagnostics-Provider%4ManagementService.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-PushNotification-Platform%4Admin.evtx -e50bef3873539bfd0254fd266eab776a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-PushNotification-Platform%4Operational.evtx -af0090405327673d025bb351998d8646 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-ReadyBoost%4Operational.evtx -c99a86c1945b9dcc4f6173e41b0a6ee7 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SMBClient%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Audit.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Connectivity.evtx -653acbbe2d65946d815868e696077d22 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SMBServer%4Security.evtx -3f07b7aeae16c1718172e5a620e644f9 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Security-Mitigations%4KernelMode.evtx -3daf3dc94ce158ddbd1f1b49958356b3 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Security-Mitigations%4UserMode.evtx -f807772e4bbb45b30c69b124e1e3bd44 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx -8c986fcdf7627f1432943c329136410a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SettingSync%4Debug.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SettingSync%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Shell-Core%4ActionCenter.evtx -f52cb57202a87eed4d754fe8cd73b6fa /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Shell-Core%4AppDefaults.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx -9a039c23dac5c82ef47d26a5482be5af /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Shell-Core%4Operational.evtx -85f3f6f6b3a48278cdb4e722d698c589 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Audit.evtx -bc0b3cb1d4b2cd89a324471e8e190137 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Connectivity.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-SmbClient%4Security.evtx -7763607d77ee9b7d16d327c9ae9eb210 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-StateRepository%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-StateRepository%4Restricted.evtx -6b613cedc37a966562fc9572352e6a79 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Storage-Storport%4Health.evtx -feef9bd830da5d90180c54ed59d0e35a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Storage-Storport%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx -3197bd6197dc24b7dc52cf8451c98b52 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx -6c117a3e2722bc682e2bdbcbf04e91dd /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Store%4Operational.evtx -f8eda81b272c5be365984085b610b14d /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Storsvc%4Diagnostic.evtx -c01a9a34aa6eac65c55d4fef2ad33fd5 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-TWinUI%4Operational.evtx -18b974aceb9db1cf9d1ffba5ee0f39e6 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-TaskScheduler%4Maintenance.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx -c846440f54e6988beff1059b6bbaa1a0 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx -a7eb6a97a6cdbd25731bd6b272a53adc /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Time-Service%4Operational.evtx -3d0e0c7222f502d2a23f43648dc409a3 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx -8022d78d45f0b4da2273c54d6ffaf313 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-User Device Registration%4Admin.evtx -e2980c8e1d485305f7ac48c74675d197 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-User Profile Service%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4ActionCenter.evtx -f024ba096dd8f72663a9ddb35db6ef56 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-UserPnp%4DeviceInstall.evtx -3ef7b145afa7ba76c702c460493bcbb6 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx -04016c45ceddf96bbfb0367f6eb9921d /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WMI-Activity%4Operational.evtx -2d6c74b37c92d8c08de610450265bb3f /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Wcmsvc%4Operational.evtx -9ccbe1f17067f3cd9efce86202cfa619 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WebAuthN%4Operational.evtx -7f45339053bd25355363d2d62d3f0ee1 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx -0d84e1a5ce324737345de6842105a8af /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WinRM%4Operational.evtx -02fc1fb597f63f4f8dc487f97795dcfe /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Defender%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Defender%4WHC.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx -6ac7883b273ec5796b2398ce9a80fffa /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx -0f9ad4da35a6108d05a094f105ac23ee /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WindowsBackup%4ActionCenter.evtx -5a03000ca2d85fe4eee09e9decdba987 /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WindowsUpdateClient%4Operational.evtx -6068c49822fb26aba56b1d78f15320da /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-Winlogon%4Operational.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Microsoft-Windows-WorkFolders%4WHC.evtx -62151832ce28e5456c2179ca735348a3 /mnt/test/p1/Windows/System32/winevt/Logs/Security.evtx -c1e79f6a32d0b3fedeb68ce5a52e7098 /mnt/test/p1/Windows/System32/winevt/Logs/Setup.evtx -cfd091be26fedb3097c2c00c9931643e /mnt/test/p1/Windows/System32/winevt/Logs/System.evtx -1f83dae35478669aef357fe90594264a /mnt/test/p1/Windows/System32/winevt/Logs/Windows PowerShell.evtx -43431814326b86743ab115f573bc39ee /mnt/test/p1/Windows/Prefetch/APPLICATIONFRAMEHOST.EXE-CCEEF759.pf -73dd8b3d1a9ad024da4658eb613efce0 /mnt/test/p1/Windows/Prefetch/AUDIODG.EXE-BDFD3029.pf -882d24d9961aa5c35bcedbc50cb29399 /mnt/test/p1/Windows/Prefetch/BACKGROUNDTASKHOST.EXE-145A3777.pf -80a13d67e2faa1b96a4ca61a364dfe09 /mnt/test/p1/Windows/Prefetch/BACKGROUNDTASKHOST.EXE-A89D33B8.pf -c817c6cc65110dd298d3df9e6603cba7 /mnt/test/p1/Windows/Prefetch/BACKGROUNDTASKHOST.EXE-ACEF2FA2.pf -8910fb95b150536866ca0f2c654eaff1 /mnt/test/p1/Windows/Prefetch/BACKGROUNDTRANSFERHOST.EXE-298EACB3.pf -828ff9601311c819f781b6de78d9cffb /mnt/test/p1/Windows/Prefetch/BACKGROUNDTRANSFERHOST.EXE-7ACF964C.pf -87a6e0e0613214cb28d4b1a3103a490b /mnt/test/p1/Windows/Prefetch/BACKGROUNDTRANSFERHOST.EXE-CF5B50C1.pf -2277c3955891bbf7476954f6ad13e086 /mnt/test/p1/Windows/Prefetch/BYTECODEGENERATOR.EXE-C1E9BCE6.pf -d83d108c1b026f89ceed224db99a115c /mnt/test/p1/Windows/Prefetch/CLOUDEXPERIENCEHOSTBROKER.EXE-E877579A.pf -14ea25208c85acc22c11f07b342cf298 /mnt/test/p1/Windows/Prefetch/CMD.EXE-4A81B364.pf -1478874454ad0c34d3c9a7bfa8fe9c53 /mnt/test/p1/Windows/Prefetch/CONHOST.EXE-1F3E9D7E.pf -12fc46fe6f81fd9d5ae68dd6f7487cb2 /mnt/test/p1/Windows/Prefetch/CONSENT.EXE-531BD9EA.pf -dce6f67ffe45f8db83d99b5cb965e7d9 /mnt/test/p1/Windows/Prefetch/CSRSS.EXE-3FE41F7E.pf -8fb6a57b455345b73c7339501b89b143 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-0F564EEF.pf -46944b352bfda259a84812632090bbec /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-28A8211F.pf -842335524005c612a7d91256a0bb1a96 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-504C779A.pf -91a7d28eee82682235ac84b1fcb896a2 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-5E46FA0D.pf -2a3f2fc1049a203b0710673a76c90f31 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-61F58501.pf -3f3295dc8d5eafcee67a842f29728657 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-766398D2.pf -1c95eef17cd7c9b13a4851ccd51e8c14 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-7CE224E3.pf -5b025ef349e04a3623e58083f7e06e3a /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-824949B9.pf -ec45ddc27bc0dd8fa52ccef250a7f883 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-A8DE6D5B.pf -934f0cc5d006fb4a53f50393b6bd0677 /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-D8E67ED6.pf -ed64ed77f2074d6caf8b85a605a9fa2b /mnt/test/p1/Windows/Prefetch/DLLHOST.EXE-FC981FFE.pf -833031410ec641afe6369721ae03abea /mnt/test/p1/Windows/Prefetch/DRVINST.EXE-4CB4314A.pf -b3e6a3302b942f13d209d2ee7a94777c /mnt/test/p1/Windows/Prefetch/DSMUSERTASK.EXE-35CC97B6.pf -867f14ef22a78371a9bb23986c0eb411 /mnt/test/p1/Windows/Prefetch/DWM.EXE-6FFD3DA8.pf -b8f45b0bf10521ebbe0fddfc6ea50fcb /mnt/test/p1/Windows/Prefetch/ELEVATION_SERVICE.EXE-732F1069.pf -19a76a5a407f3ac2755f49adbc4c3f36 /mnt/test/p1/Windows/Prefetch/FILESYNCCONFIG.EXE-2C117A8A.pf -6406fc777623fec9aa24e212a0d40e78 /mnt/test/p1/Windows/Prefetch/FILESYNCCONFIG.EXE-C3FC22CD.pf -402cc389db378226e0a11e09b11abd10 /mnt/test/p1/Windows/Prefetch/FIRSTLOGONANIM.EXE-674CDAB9.pf -54d0d81deac296b4c3c0d19fc250c41c /mnt/test/p1/Windows/Prefetch/FODHELPER.EXE-8ECD01E5.pf -47172ac3b3d73fa14631de16a110891f /mnt/test/p1/Windows/Prefetch/FONTDRVHOST.EXE-31E45F6D.pf -00eaa80d319adc86820681df3a41cb94 /mnt/test/p1/Windows/Prefetch/FSQUIRT.EXE-BBD9646E.pf -6163cdce9dbf6963db8afafe1609c88e /mnt/test/p1/Windows/Prefetch/IDENTITY_HELPER.EXE-4452DF34.pf -822d78c64db728ccb027aac31dfbab4a /mnt/test/p1/Windows/Prefetch/INFDEFAULTINSTALL.EXE-39AFC5CD.pf -8ac6b67557dda5387934fae34e65d223 /mnt/test/p1/Windows/Prefetch/LOCALBRIDGE.EXE-BF9EA5D6.pf -59d9921693e74070b5515e2a18bb28b6 /mnt/test/p1/Windows/Prefetch/LOGONUI.EXE-09140401.pf -ce3de8ecae885676f9799af07691028c /mnt/test/p1/Windows/Prefetch/LPREMOVE.EXE-284EF282.pf -a5c6a94718aacbe952f864380c153e27 /mnt/test/p1/Windows/Prefetch/MICROSOFTEDGEUPDATE.EXE-C4317749.pf -1e41f7d76258c5d9169bacf1c2e28a8e /mnt/test/p1/Windows/Prefetch/MICROSOFTEDGE_X64_124.0.2478.-60018742.pf -699c52453118cd297d6458823bc21b04 /mnt/test/p1/Windows/Prefetch/MMC.EXE-1F0780FE.pf -adb98269cb15970bc4bdf5a82f1c9533 /mnt/test/p1/Windows/Prefetch/MOUSOCOREWORKER.EXE-681A8FEE.pf -98e926dc4f75f205e3d928fe102d8f83 /mnt/test/p1/Windows/Prefetch/MSCONFIG.EXE-3A52734E.pf -a4920ec59363bcddfba63cafa8c94aa6 /mnt/test/p1/Windows/Prefetch/MSEDGE.EXE-78F14B85.pf -c5ce751bb6fca99703e0e322119ff841 /mnt/test/p1/Windows/Prefetch/MSEDGE.EXE-78F14B86.pf -444d3e2b1aafa779cdc98f782b904f75 /mnt/test/p1/Windows/Prefetch/MSEDGE.EXE-78F14B87.pf -e03398fd53d65229a300e088f7183752 /mnt/test/p1/Windows/Prefetch/MSEDGE.EXE-78F14B88.pf -9565dbfca34b5cb643ef4b4cebb1b013 /mnt/test/p1/Windows/Prefetch/MSEDGE.EXE-78F14B89.pf -3b10d73649617d2cc645ea581c8e4426 /mnt/test/p1/Windows/Prefetch/MSEDGE.EXE-78F14B8D.pf -696df1c88a21261d2e5cb9f4671d0121 /mnt/test/p1/Windows/Prefetch/NISSRV.EXE-4999B98F.pf -ddfff2f9d2ff2232249cbece86b72a35 /mnt/test/p1/Windows/Prefetch/NOTEPAD.EXE-D8414F97.pf -c4d97c8855b6af16c337f1b3b49251aa /mnt/test/p1/Windows/Prefetch/ONEDRIVE.EXE-7E152375.pf -a380e198b9c4f55eb17f8c5c33f63e40 /mnt/test/p1/Windows/Prefetch/ONEDRIVESETUP.EXE-59F296DD.pf -168a76f0735561b54ad2d4d50e9f7fce /mnt/test/p1/Windows/Prefetch/ONEDRIVESETUP.EXE-ADFC0EFD.pf -49df727160d1a6cca61872299c8d8a3d /mnt/test/p1/Windows/Prefetch/RUNDLL32.EXE-23EA2E5B.pf -5af07713383952987fe6fe0c65c7c610 /mnt/test/p1/Windows/Prefetch/RUNDLL32.EXE-CF0EC82C.pf -f0d09a64c0fd4637cdfe0234081b0646 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-005D3145.pf -591b2d5be6d67e8227652d2855d9b4f8 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-06226CEB.pf -a9adf31d18cb8a1676552c3604986daf /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-0BC9E071.pf -23a85a50a954e25e5c2f8d36a98343b7 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-3ED30A86.pf -0eaa0b4eef14485daabe66f472af4ffd /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-4DE02988.pf -136151e0ad0091331bab189e0e151f16 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-6457DB07.pf -50b57e0ed2d8452159dd99fc0e1b449f /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-72C0C855.pf -72ef766481a96f8e2a485639fface641 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-94A02D86.pf -3525442b6f14a0e42ec132033b5ecb35 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-98C67737.pf -9530d2d2ac5e5b07366ffe5c860ddebd /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-98F22970.pf -c1715b23103475917ec0bcb658885399 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-B1A87C0F.pf -9edd9f5b706198b9efdb9199453846fb /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-BC366267.pf -d3b778b985316265e43775f2698a90eb /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-C4B5739C.pf -18f3c0c03af628801bb2da46cac36af8 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-D9106866.pf -da82f72f709b76119a3924565ce61b7b /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-E09422A7.pf -fa3dd8f623510bc3f9369fbdf0deeda1 /mnt/test/p1/Windows/Prefetch/RUNTIMEBROKER.EXE-E70C9E46.pf -1c50ca230aac462623805e9d5ee1f067 /mnt/test/p1/Windows/Prefetch/SC.EXE-945D79AE.pf -6db4ee67499d6af26fce542dde6027a9 /mnt/test/p1/Windows/Prefetch/SEARCHAPP.EXE-31329E1E.pf -bcfe633f127b5c633f7ee0b9f5ff3599 /mnt/test/p1/Windows/Prefetch/SEARCHAPP.EXE-AEF051F3.pf -938690ae314e3bd61864595c462dcc82 /mnt/test/p1/Windows/Prefetch/SEARCHFILTERHOST.EXE-77482212.pf -466f69d85ca43117c01af678e546eb30 /mnt/test/p1/Windows/Prefetch/SEARCHINDEXER.EXE-4A6353B9.pf -aabdc6f54cf709a33b1373cca9d08298 /mnt/test/p1/Windows/Prefetch/SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf -273bd52ed2878bc982c1e4583e5064d7 /mnt/test/p1/Windows/Prefetch/SECURITYHEALTHSERVICE.EXE-EE3BC4CB.pf -f9687b60c1bf3e90a35f7f2ceae092f7 /mnt/test/p1/Windows/Prefetch/SECURITYHEALTHSYSTRAY.EXE-41AD6DE1.pf -3355ca10544642a2b01ba84793a8d318 /mnt/test/p1/Windows/Prefetch/SETTINGSYNCHOST.EXE-2521C7ED.pf -2298076fbfbabd21d857059fcaf74961 /mnt/test/p1/Windows/Prefetch/SETUP.EXE-7BF22A15.pf -6b58b1239706d127d7e5dbe6f59ac2c5 /mnt/test/p1/Windows/Prefetch/SETUP.EXE-7BF22A19.pf -55b072c05f6a84e894d57d61edee9c69 /mnt/test/p1/Windows/Prefetch/SETUP.EXE-8E6CB48D.pf -3cd02a7157a1abd79916c2700cbc5872 /mnt/test/p1/Windows/Prefetch/SETUP.EXE-8E6CB491.pf -70017c34e098c8c5eb41b3396dac603c /mnt/test/p1/Windows/Prefetch/SGRMBROKER.EXE-0CA31CC6.pf -fbc8875a6a09c385f78c5a769749f3ab /mnt/test/p1/Windows/Prefetch/SHELLEXPERIENCEHOST.EXE-EF3EE583.pf -f4e74ef18a7d9503beb2176a9195a70d /mnt/test/p1/Windows/Prefetch/SLUI.EXE-724E99D9.pf -5be37635f636d017fbfde7ba620ff309 /mnt/test/p1/Windows/Prefetch/SMARTSCREEN.EXE-9B5E4173.pf -4c22778ff1fe43022eafb812f11b2f07 /mnt/test/p1/Windows/Prefetch/SMSS.EXE-E9C28FC6.pf -f4486aa4cebfb944d9955c87f200c07d /mnt/test/p1/Windows/Prefetch/SPPSVC.EXE-B0F8131B.pf -e575df3bdf2775e7649ed190b0bee810 /mnt/test/p1/Windows/Prefetch/STARTMENUEXPERIENCEHOST.EXE-D80E778C.pf -d6372c1cc37a56fea5185b58a0bd7dba /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-033BBABB.pf -3775d0a0a8846c22f20ca88a4801f40d /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-090AEBE5.pf -84b25a9bcc3f665d9bbefc05b479bb45 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-0B3A9016.pf -b54b913863c0fe72f2155d7e2df8dc05 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-11FFA705.pf -80f4a5fb0e8e8d1f6f1d7ec3797bdcd7 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-197FABCA.pf -e19ebedc22feaa7da8cd2ae1a1d7e430 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-25616620.pf -0d8cd6614a0bfb5a53d95a00d34ec94a /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-2D56ECA4.pf -774a3a75c28cf6f60748c2afa77dd932 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-2F0E0AF4.pf -deadf9c7d094ccea797b84d5795caa01 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-342BD74A.pf -ea9abab3c9ce34ff2019addf5c222f97 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-3E5AE7B5.pf -d76c6257927be9f03f1aa5f06b5b80e5 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-49268D52.pf -5415e3bbd7de2682ac1b8be8d0baca1e /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-4BA0E729.pf -8de3c578e934c6ae267baa8c7e0462c9 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-5AC380EC.pf -4b242738ba44ec0c7f86681c6ffb11c7 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-6378753E.pf -93f8038cd564f5f8e53d3d32a8464fc1 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-6CD6E9CE.pf -63930a7ca7754b4d5db352156dbdc32d /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-7CFEDEA3.pf -7c5aeab08b49f129693c3f6be677679d /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-8102A33C.pf -fd6dd9ca815f5c422df8c2c947687afa /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-871F52B2.pf -c00f8938f25e4ca9671093cf24c1b5bf /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-96A7E1CF.pf -ae7d6790527053bb74a5ac021b7fa6d7 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-96E5235B.pf -a9428fb07963bfd0615d45fc8f668920 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-9EE05E7E.pf -940e1af0468a8fb7a21bceb3d4833628 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-9F4DB6F5.pf -fe904a717afd702143fec9b5d2ed7d4f /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-AE7DB802.pf -254ec2f922f497db495d10ba492a35a8 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-B12DB959.pf -4ffe31c46203bf36bd4c0ccee354911f /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-B25CCDFF.pf -3cdf4dbb900489fcfe70a429487a7483 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-C49E779A.pf -59e198972555eb42f99bf0fc8a6a5b01 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-D217A328.pf -a2cf2dc694a1cd2b2c505b9be740ca6c /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-DF3D779F.pf -c28df2c45b5cad51fb1b2dafb3dc8e1d /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-E3D0CD52.pf -9a6548af64aac16467e788da28b61de9 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-E8610451.pf -52f761a53e9a9425cac469b6f823264d /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-EDE0F878.pf -f4349fc9fb87ce7d61f54c88631767c1 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-EE1C9ACA.pf -3770441311cbeb76803db7c5217d1dc3 /mnt/test/p1/Windows/Prefetch/SVCHOST.EXE-F027B880.pf -fb1dd982a2836021c6744e1988a34203 /mnt/test/p1/Windows/Prefetch/SYSTEMSETTINGS.EXE-01D72268.pf -5f8854064748399b50e9926af64d1dfa /mnt/test/p1/Windows/Prefetch/SYSTEMSETTINGSBROKER.EXE-CBC37DFF.pf -18dffc63b461132b5b56d2b204b286c4 /mnt/test/p1/Windows/Prefetch/TASKHOSTW.EXE-3E0B74C8.pf -5643741940b8af3662eb46cb0f4fa1f1 /mnt/test/p1/Windows/Prefetch/TASKMGR.EXE-5F5F473D.pf -951ba84e870551f9d41c877af8562c06 /mnt/test/p1/Windows/Prefetch/TEXTINPUTHOST.EXE-6DC31D2B.pf -60fd7a944b04c3c1ec89ce7bb95e46d4 /mnt/test/p1/Windows/Prefetch/TIWORKER.EXE-D65B4EA9.pf -30e2e849ff4e064c834d451c652fae20 /mnt/test/p1/Windows/Prefetch/TRUSTEDINSTALLER.EXE-3CC531E5.pf -df6c972bdc7ac4e547970e0a54e94cbe /mnt/test/p1/Windows/Prefetch/USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf -9ec245e2a7921a04c834aa062632cce2 /mnt/test/p1/Windows/Prefetch/USEROOBEBROKER.EXE-D2992F42.pf -538b9307c2f013af60333d88277e3a4e /mnt/test/p1/Windows/Prefetch/VBOXCERTUTIL.EXE-8CF5E144.pf -ab3602585f97c9dd5b0ddfdbfe551eb3 /mnt/test/p1/Windows/Prefetch/VBOXDRVINST.EXE-7DCD6070.pf -eae1bd1723608b5dd4b0ff293d6dc296 /mnt/test/p1/Windows/Prefetch/VBOXTRAY.EXE-1D286C83.pf -0681a86910cb142237378f4ac82f7909 /mnt/test/p1/Windows/Prefetch/VBOXWINDOWSADDITIONS-AMD64.EX-85C5A15E.pf -f213a7b051ebe7340c3e5a5e26fda926 /mnt/test/p1/Windows/Prefetch/VDS.EXE-6E7946F9.pf -f9aa562c709712b05e4ef640355c7967 /mnt/test/p1/Windows/Prefetch/VDSLDR.EXE-6B089E8B.pf -b7f1f0dcdd0f1f6dc989f773208364e6 /mnt/test/p1/Windows/Prefetch/VERCLSID.EXE-7C52E31C.pf -7c506ccc9e8993a1b8ae658d2b1eff5e /mnt/test/p1/Windows/Prefetch/VSSVC.EXE-B8AFC319.pf -60e08d50caed491bae97c62cfefbeef2 /mnt/test/p1/Windows/Prefetch/WINLOGON.EXE-B020DC41.pf -5912196aee9559c76328cee442219c23 /mnt/test/p1/Windows/Prefetch/WLRMDR.EXE-C2B47318.pf -0e8334395f4f4e1401a3a442f3f1b5a5 /mnt/test/p1/Windows/Prefetch/WMIADAP.EXE-F8DFDFA2.pf -b6d0a5ea655f09277380ef19709a7769 /mnt/test/p1/Windows/Prefetch/WMIPRVSE.EXE-1628051C.pf -463aaf13c04c8bb6ce4bc5ee10c58e47 /mnt/test/p1/Windows/Prefetch/WUAUCLT.EXE-70318591.pf -a97a7b3970c269f223071ebe3e07a7a8 /mnt/test/p1/Windows/Prefetch/WWAHOST.EXE-3FD45057.pf -09fb75451c8ad02bf2ae9bb5f354e497 /mnt/test/p1/Windows/Prefetch/WWAHOST.EXE-DB0D8801.pf -457ac420ff6d54e6eafd5aa0b2f85462 /mnt/test/p1/Windows/AmCompat/Programs/Amcache.hve -fe688738b76340f6e673145f5ab5f3f1 /mnt/test/p1/Users/Test/NTUSER.DAT -7fcc9484350f79e946785a91c059ac62 /mnt/test/p1/Users/Test/AppData/Local/Microsoft/Windows/UsrClass.dat -d5d618a6aa245de47c7cc2757809ac18 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/5f7b5f1e01b83767.automaticDestinations-ms -be73685f29b52055fd5e7cf2cac6ca71 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/9b9cdc69c1c24e2b.automaticDestinations-ms -72f5c05b7ea8dd6059bf59f50b22df33 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/a2744a7f80b3ce43.automaticDestinations-ms -012169df681487445802d59adedbd131 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/ccba5a5986c77e43.automaticDestinations-ms -23e89805c4ed576ea232023467fd26f2 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/f01b4d95cf55d32a.automaticDestinations-ms -6852e3a0bf1c01bb4dbfcb51c1a7c087 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/7e4dca80246863e3.customDestinations-ms -36a17ee60f0e3dbc74606c1024a2bf35 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/ccba5a5986c77e43.customDestinations-ms -b9bd716de6739e51c620f2086f9c31e4 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/f01b4d95cf55d32a.customDestinations-ms -4fcb2a3ee025e4a10d21e1b154873fe2 /mnt/test/p1/Users/Test/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/f18460fded109990.customDestinations-ms -b6b6f9ef7444670f8d8a48628bddbdef /mnt/test/p1/Users/Test/AppData/Local/Google/Chrome/User Data/Default/History -566f08ec5bbdebd14ec8cd4c50cd15cd /mnt/test/p1/Users/Test/AppData/Local/Microsoft/Edge/User Data/Default/History -eae4860170f8dc92bbb865cccef9bf8f /mnt/test/p1/Users/Test/AppData/Roaming/Mozilla/Firefox/Profiles/p8b7q64j.default-release/places.sqlite -cecd2324775f1d23211ca8cfc2e9d891 /mnt/test/p1/Users/Test/AppData/Roaming/Opera Software/Opera Stable/Default/History \ No newline at end of file