Velocidex/go-ese

WebCacheV01.dat missing ResponseHeaders

Closed this issue · 1 comments

I have been looking at a few WebCacheV01.dat files and doing some spot checking to see what go-ese parses versus what ESEDatabaseView shows. In some of the Container_ tables, the ResponseHeader columns sometimes show what appears to be more valid data in ESEDatabaseView. Where it shows string data, go-ese shows just a few bytes of non-string data. The strings in these columns can be pretty long (KBs). In digging around the go-ese code and documentation, I keep seeing hints that Long Values may not be implemented. Is that possibly the case, and a possible cause?

This was a problem with long values. So this issue is a duplicate of #21 and fixed by #22