Index: trunk/bin/reglookup-timeline
===================================================================
--- trunk/bin/reglookup-timeline	(revision 169)
+++ trunk/bin/reglookup-timeline	(revision 170)
@@ -5,5 +5,5 @@
 # timelines for investigations.
 #
-# Copyright (C) 2005-2007 Timothy D. Morgan
+# Copyright (C) 2005-2007,2010 Timothy D. Morgan
 #
 # This program is free software; you can redistribute it and/or modify
@@ -25,6 +25,7 @@
 usage()
 {
-  echo "Usage: $0 [-H] <REGISTRY_FILE> [<REGISTRY_FILE> ...]" 1>&2
+  echo "Usage: $0 [-H] [-V] <REGISTRY_FILE> [<REGISTRY_FILE> ...]" 1>&2
   echo "   -H  Omit header line" 1>&2
+  echo "   -V  Include values with parent timestamps" 1>&2
 }
 
@@ -41,4 +42,10 @@
 fi
 
+OPTS='-t KEY'
+if [ "$1" = "-V" ]; then
+  OPTS='-i'
+  shift
+fi
+
 if [ "$PRINT_HEADER" = "true" ]; then
   echo "MTIME,FILE,PATH"
@@ -46,4 +53,4 @@
 
 for F in $@; do
-  reglookup -t KEY -H "$F" | awk -F',' '{ printf "%s,'"$F"',%s\n",$4,$1; }'
+  reglookup $OPTS -H "$F" | awk -F',' '{ printf "%s,'"$F"',%s\n",$4,$1; }'
 done | sort
Index: trunk/doc/reglookup.1.docbook
===================================================================
--- trunk/doc/reglookup.1.docbook	(revision 169)
+++ trunk/doc/reglookup.1.docbook	(revision 170)
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="UTF-8"?>
+???<?xml version="1.0" encoding="UTF-8"?>
 <refentry id='reglookup.1'>
   <!--  $Id$ -->
@@ -82,4 +82,22 @@
 	  <para>
 	    Enables the printing of a column header row. (default)
+	  </para>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+    
+    <variablelist remap='IP'>
+      <varlistentry>
+        <term>
+          <option>-i</option>
+        </term>
+        <listitem>
+	  <para>
+	    Printed values inherit the timestamp of their parent key, which is
+            printed along with them.  Note that this timestamp is not
+            necessarily meaningful for any given value values because timestamps
+            are saved on keys only and you cannot tell which value has been
+            modified since a change to any value of a given key would update the
+            time stamp.
 	  </para>
         </listitem>
Index: trunk/src/common.c
===================================================================
--- trunk/src/common.c	(revision 169)
+++ trunk/src/common.c	(revision 170)
@@ -29,5 +29,5 @@
 const char* common_special_chars = ",\"\\";
 
-#define REGLOOKUP_VERSION "0.11.0"
+#define REGLOOKUP_VERSION "0.12.0"
 
 #define REGLOOKUP_EXIT_OK       0
Index: trunk/src/reglookup.c
===================================================================
--- trunk/src/reglookup.c	(revision 169)
+++ trunk/src/reglookup.c	(revision 170)
@@ -2,5 +2,6 @@
  * A utility to read a Windows NT and later registry files.
  *
- * Copyright (C) 2005-2009 Timothy D. Morgan
+ * Copyright (C) 2005-2010 Timothy D. Morgan
+ * Copyright (C) 2010 Tobias Mueller (portions of '-i' code)
  * Copyright (C) 2002 Richard Sharpe, rsharpe@richardsharpe.com
  *
@@ -31,4 +32,5 @@
 
 /* Globals, influenced by command line parameters */
+bool print_value_mtime = false;
 bool print_verbose = false;
 bool print_security = false;
@@ -57,4 +59,7 @@
   char* conv_error = NULL;
   const char* str_type = NULL;
+  char mtime[20];
+  time_t tmp_time[1];
+  struct tm* tmp_time_s = NULL;
 
   if(vk->valuename == NULL)
@@ -97,22 +102,31 @@
   }
 
+  if(print_value_mtime)
+  {
+    *tmp_time = regfi_nt2unix_time(&iter->cur_key->mtime);
+    tmp_time_s = gmtime(tmp_time);
+    strftime(mtime, sizeof(mtime), "%Y-%m-%d %H:%M:%S", tmp_time_s);
+  }
+  else
+    mtime[0] = '\0';
+
   str_type = regfi_type_val2str(vk->type);
   if(print_security)
   {
     if(str_type == NULL)
-      printf("%s/%s,0x%.8X,%s,,,,,\n", prefix, quoted_name,
-	     vk->type, quoted_value);
-    else
-      printf("%s/%s,%s,%s,,,,,\n", prefix, quoted_name,
-	     str_type, quoted_value);
+      printf("%s/%s,0x%.8X,%s,%s,,,,\n", prefix, quoted_name,
+	     vk->type, quoted_value, mtime);
+    else
+      printf("%s/%s,%s,%s,%s,,,,\n", prefix, quoted_name,
+	     str_type, quoted_value, mtime);
   }
   else
   {
     if(str_type == NULL)
-      printf("%s/%s,0x%.8X,%s,\n", prefix, quoted_name,
-	     vk->type, quoted_value);
-    else
-      printf("%s/%s,%s,%s,\n", prefix, quoted_name,
-	     str_type, quoted_value);
+      printf("%s/%s,0x%.8X,%s,%s\n", prefix, quoted_name,
+	     vk->type, quoted_value, mtime);
+    else
+      printf("%s/%s,%s,%s,%s\n", prefix, quoted_name,
+	     str_type, quoted_value, mtime);
   }
 
@@ -548,4 +562,5 @@
   fprintf(stderr, "\t-p\t restrict output to elements below this path.\n");
   fprintf(stderr, "\t-t\t restrict results to this specific data type.\n");
+  fprintf(stderr, "\t-i\t includes parent key modification times with child values.\n");
   fprintf(stderr, "\n");
 }
@@ -605,4 +620,6 @@
     else if (strcmp("-v", argv[argi]) == 0)
       print_verbose = true;
+    else if (strcmp("-i", argv[argi]) == 0)
+      print_value_mtime = true;
     else
     {
