Changeset 119

Timestamp:

08/09/08 01:55:45 (16 years ago)

Author:

tim

Message:

adding reglookup-recover man page

Location:

trunk/doc

Files:

• Makefile (modified) (2 diffs)
• reglookup-recover.1.docbook (added)
• reglookup-timeline.1.docbook (modified) (4 diffs)
• reglookup.1.docbook (modified) (9 diffs)

trunk/doc/Makefile

@@ -1 +1 @@
 # $Id$
 
-BUILD_FILES=$(BUILD_DOC)/man/man1/reglookup.1.gz $(BUILD_DOC)/man/man1/reglookup-timeline.1.gz
+BUILD_FILES=$(BUILD_DOC)/man/man1/reglookup.1.gz\
+        $(BUILD_DOC)/man/man1/reglookup-timeline.1.gz\
+        $(BUILD_DOC)/man/man1/reglookup-recover.1.gz
 
 default: $(BUILD_FILES)
 
-$(BUILD_DOC)/man/man1/reglookup.1.gz: man/man1/reglookup.1.gz
+$(BUILD_DOC)/man/man1:
         mkdir -p $(BUILD_DOC)/man/man1
+
+$(BUILD_DOC)/man/man1/reglookup.1.gz: man/man1/reglookup.1.gz $(BUILD_DOC)/man/man1
         cp man/man1/reglookup.1.gz $@
 
-$(BUILD_DOC)/man/man1/reglookup-timeline.1.gz: man/man1/reglookup-timeline.1.gz
-        mkdir -p $(BUILD_DOC)/man/man1
+$(BUILD_DOC)/man/man1/reglookup-timeline.1.gz: man/man1/reglookup-timeline.1.gz $(BUILD_DOC)/man/man1
         cp man/man1/reglookup-timeline.1.gz $@
+
+$(BUILD_DOC)/man/man1/reglookup-recover.1.gz: man/man1/reglookup-recover.1.gz $(BUILD_DOC)/man/man1
+        cp man/man1/reglookup-recover.1.gz $@
 
 install:
@@ -22 +28 @@
         docbook2x-man --to-stdout reglookup.1.docbook > man/man1/reglookup.1
         docbook2x-man --to-stdout reglookup-timeline.1.docbook > man/man1/reglookup-timeline.1
+        docbook2x-man --to-stdout reglookup-recover.1.docbook > man/man1/reglookup-recover.1
         cd man/man1 && gzip -9 -f reglookup.1
         cd man/man1 && gzip -9 -f reglookup-timeline.1
+        cd man/man1 && gzip -9 -f reglookup-recover.1

trunk/doc/reglookup-timeline.1.docbook

@@ -9 +9 @@
   <refnamediv id='name'>
     <refname>reglookup-timeline</refname>
-    <refpurpose>windows NT+ registry MTIME timeline generator</refpurpose>
+    <refpurpose>Windows NT+ registry MTIME timeline generator</refpurpose>
   </refnamediv>
 
@@ -28 +28 @@
       This script is a wrapper for <command>reglookup(1)</command>, and reads
       one or more registry
-      files to produce an MTIME sorted output.  This is helpful when building
+      files to produce an MTIME-sorted output.  This is helpful when building
       timelines for forensic investigations.
     </para>
@@ -99 +99 @@
       distribution.
     </para>
-    <para>      
+    <para>
       This program is distributed in the hope that it will be useful,
       but WITHOUT ANY WARRANTY; without even the implied warranty of
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-      GNU General Public License version 2 for more details.
+      GNU General Public License version 3 for more details.
     </para>
   </refsect1>
@@ -110 +110 @@
     <title>SEE ALSO</title>
     <para>
-      reglookup(1)
+      reglookup(1) reglookup-recover(1)
     </para>
   </refsect1>

trunk/doc/reglookup.1.docbook

@@ -9 +9 @@
   <refnamediv id='name'>
     <refname>reglookup</refname>
-    <refpurpose>windows NT+ registry reader/lookup tool</refpurpose>
+    <refpurpose>Windows NT+ registry reader/lookup tool</refpurpose>
   </refnamediv>
 
@@ -27 +27 @@
         print them out to stdout in a CSV-like format.  It has filtering
         options to narrow the focus of the output.  This tool is
-        designed to work with on windows NT/2K/XP/2K3 registries, though
-        your mileage may vary.
+        designed to work with on Windows NT/2K/XP/2K3/Vista registries, 
+        though your mileage may vary.
     </para>
   </refsect1>
@@ -61 +61 @@
             Specify a type filter.  Only elements which match this
             registry data type will be printed.  Acceptable values
-            are: 
+            are:
             <command>
               NONE, SZ, EXPAND_SZ, BINARY, DWORD, DWORD_BE,
@@ -111 +111 @@
             information from key security descriptors.  The columns 
             are: owner, group, sacl, dacl.
-            (This feature's output probably contains bugs right now.)
+            (This feature's output has not been extensively tested.)
           </para>
         </listitem>
@@ -152 +152 @@
           <para>
             Required argument.  Specifies the location of the
-            registry file to read.  Typically, these files will be
-            found on a NTFS partition under
+            registry file to read.  The system registry files should be
+            found under:
             <command>%SystemRoot%/system32/config</command>.
           </para>
@@ -293 +293 @@
     <title>BUGS</title>
     <para>
-      This program has only been tested on a few different systems.
-      (Please report results to the development list if you test it 
-      on Windows NT 4.0, 2003, or Vista registries.  Also, if you 
-      test on any 64-bit architecture, please contact us.)
+      This program has been smoke-tested against most current Windows target 
+      platforms, but a comprehensive test suite has not yet been developed.
+      (Please report results to the development mailing list if you encounter
+       any bugs.  Sample registry files and/or patches are greatly appreciated.)
     </para>
     <para>
@@ -314 +314 @@
       Backslashes are currently considered special characters, to make 
       parsing easier for automated tools.  However, this causes paths 
-      to be difficult to read.
-    </para>
-    <para>
-      You'll notice that registry paths aren't all the same as the
-      equivalents you see in the windows registry editor.  This is because
-      Windows constructs the registry view from multiple registry files, 
-      each with their own roots.  This utility merely shows what exists 
-      under a single root.  This isn't really a bug, but one should be 
-      aware of the differences in path.
+      to be difficult to read by mere mortals.
+    </para>
+    <para>
+      For more information on registry format details, see:
+        http://sentinelchicken.com/research/registry_format/
     </para>
   </refsect1>
@@ -350 +346 @@
       but WITHOUT ANY WARRANTY; without even the implied warranty of
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-      GNU General Public License version 2 for more details.
+      GNU General Public License version 3 for more details.
     </para>
   </refsect1>
@@ -357 +353 @@
     <title>SEE ALSO</title>
     <para>
-      reglookup-timeline(1)
+      reglookup-timeline(1) reglookup-recover(1)
     </para>
   </refsect1>