Public/ConvertFrom-NSPLastActivityView.ps1
|
function ConvertFrom-NSPLastActivityView { <# .SYNOPSIS Reads a NirSoft LastActivityView text export into named properties. .DESCRIPTION Uses the labeled-block reader and parses Action Time with the given culture. ActionTimeText and _Raw retain the original text and fields. #> [CmdletBinding()] param( [Parameter(Mandatory)][ValidateNotNullOrEmpty()][string]$Path, [ValidateNotNullOrEmpty()][string]$Culture = 'en-US' ) $cultureInfo = [Globalization.CultureInfo]::GetCultureInfo($Culture) $labels = @('Action Time', 'Description', 'Filename', 'Full Path', 'More Information', 'File Extension', 'Data Source') ConvertFrom-NSPLabeledBlockLog -Path $Path | ForEach-Object { $record = $_ foreach ($label in $labels) { if (-not $record.Fields.PSObject.Properties[$label]) { throw "Missing '$label' at record $($record.RecordNumber)." } } $timeText = [string]$record.Fields.'Action Time' $actionTime = [datetime]::MinValue if (-not [datetime]::TryParse($timeText, $cultureInfo, [Globalization.DateTimeStyles]::None, [ref]$actionTime)) { throw "Invalid Action Time at record $($record.RecordNumber)." } [pscustomobject]@{ RecordNumber = $record.RecordNumber ActionTime = $actionTime ActionTimeText = $timeText Description = $record.Fields.Description Filename = $record.Fields.Filename FullPath = $record.Fields.'Full Path' MoreInformation = $record.Fields.'More Information' FileExtension = $record.Fields.'File Extension' DataSource = $record.Fields.'Data Source' _Raw = $record } } } |