Hoppa till innehÄll

  • Logga in via Facebook Logga in via Twitter Logga in via Windows Live Log In with LinkedIn Log In with Google      Sign In   
  • Registrera dig nu!





Foto

Restoring Internet Explorer favorites from an invalid UE-V package

  Skriven av Andreas Stenhall , 02 March 2017 · 1208 visningar

Those of you who know me know that I am somewhat stubborn and I never give up. This case could easily have gotten anyone to crack! This blog post shows a way to restore favorites from within a UE-V (User Experience Virtualization) package that UE-V cannot use to roam the favorites, as the package is considered invalid.
Problem

A user has created some 2346(!) favorites in Internet Explorer over the years. UE-V is used to roam favorites. After the user reinstalled the machine from Windows 7 to Windows 10, the favorites went missing.
Investigation

To start with, the package supposedly containing the favorites (MicrosoftInternetExplorer.common.pkgx) could still be found in the SettingsPackages folder and the size was 1,24MB and dated just a week ago. Those of you that have worked with UE-V know that a package that large signals that it contains a rather large amount data. Therefore, with that indication I assumed that the favorites is still lurking in there.
First thing to try was to just force the read of the package using via the UE-V agent as is the case whenever IE is started or closed, however Event Viewer revealed that UE-V thinks there is some kind of problem with the package.
The initial settings package for settings location template "MicrosoftInternetExplorer.common" is invalid. The initial settings package will be replaced with a new copy.
Now it is time to analyze the package itself. Note: This took quite some time to process by the cmdlet and it seems that the UE-V agents takes the same amount of time to process this large amount of favorites (~30 seconds).
Export-UevPackage c:tempMicrosoftInternetExplorer.common.pkgx | out-file C:temp MicrosoftInternetExplorer.common.txt
Reading the output text file revealed that the user had 2346 favorites, data in the following format:
<SettingsDocument>
<file>
<Setting Type="VT_FILE" Name="file://{1777F761-68AD-4D8A-87BD-30B759FA33DD}Folder1Name of site 1.url" Action="Update">FEBB399A-8DF5-4B3D-B73D-A8167F61EB6B.pkgdat</Setting>
<Setting Type="VT_FILE" Name="file://{1777F761-68AD-4D8A-87BD-30B759FA33DD}Folder1Name of site 2.url" Action="Update">9FA223F9-F065-4269-B02C-E467A6B26459.pkgdat</Setting>
<Setting Type="VT_FILE" Name="file://{1777F761-68AD-4D8A-87BD-30B759FA33DD}Folder2Name of site 3.url" Action="Update">2393C0D8-AEDE-4D11-9CE3-E7E1E4B039CA.pkgdat</Setting>
...


Next up, rename the MicrosoftInternetExplorer.common.pkgx to MicrosoftInternetExplorer.common.zip and open it up. Note that you probably also would want to unblock the ZIP file before extracting the contents, choosing Properties and Unblock. Opening the PKGX as a ZIP shows us all the PKGDAT files listed in the output from Export-UevPackage. Extract the PKGDAT files to a folder, in my example c:TempPKGDAT.
With these data sources, we have everything we need to recreate the URLs and their structure. Basically, what we need from the output from Export-UevPackage is the folder where the URL file is stored, the name of the URL file and the name of the PKGDAT filename.
Solution

With the aforementioned pieces of data, we can automate and match this to rebuild the Favorites entirely, using this PowerShell script:
$urls = (Export-UevPackage c:tempMicrosoftInternetExplorer.common.pkgx).split(“`n”) | select-string VT_FILE
foreach ($extracted in $urls)
{
$hash1 = $extracted -split ‘<Setting Type=|Name=|Action=|</Setting>’
$folder = $hash1[2].split(“”)[1]
$urlname = $hash1[2].split(“”)[-1].Replace(‘”‘,“”)
$pkgdat= $hash1[3].Split(“>”)[1]
New-Item c:tempRestoredURLs$folder -type directory
if ($folder -match ‘”‘)
{
Copy-Item c:tempPKGDAT$pkgdat c:tempRestoredURLs$urlname
} else {
Copy-Item c:tempPKGDAT$pkgdat c:tempRestoredURLs$folder$urlname
}
}
This recreated the favorites and in the same structure as it was! The user was indeed very happy!
Thanks goes to my colleague Jimmy Benandex who helped in making the above PowerShell command. As he mentioned there are better ways of doing the matching but I consider what we produced as a good enough solution :)

KĂ€lla




December 2017

M T O T F L S
    123
45678910
11 121314151617
18192021222324
25262728293031

Twitter