C#

<drives>
    <drive identifier="C">
        <folders>
            <folder name="Program Files">
                <folders>
                    <folder name="Some Folder">
                        <folders />
                        <files>
                            <file name="MyApplication.exe" size="1064322" />
                            <file name="MyLibrary.dll" size="103223" />
                        </files>
                    </folder>
                    <files />
                </folders>
            </folder>
        </folders>
        <files>
            <file name="Some Junk.txt" size="2310" />
        </files>
    </drive>
</drives>

xsd.exe D:\Temp\gpx.xsd /classes /out:D:\Temp /language:CS

static string GetFullPath(XElement fileElement)
{
    var names = new HashSet<XName> { "Drive", "Folder", "File" };
    
    IEnumerable<string> pathParts = fileElements.AncestorsAndSelf()
        .Where(el => names.Contains(el.Name))
        .Select(el => (string)el.Element("Name"))
        .Reverse();
    
    return string.Join("\\", pathParts);
}

...

const string xml = @"<Drive>
    <Name>C:</Name>
    <ContainedFolders>
        <Folder>
            <Name>Program Files</Name>
            <ContainedFolders>
                <Folder>
                    <Name>VirtualBox</Name>
                    <ContainedFolders>
                        <Folder>
                            <Name>Test</Name>
                            <ContainedFiles>
                                <File>
                                    <Name>qtaccessiblewidgets4.dll</Name>
                                </File>
                            </ContainedFiles>
                        </Folder>
                    </ContainedFolders>
                </Folder>
            </ContainedFolders>
        </Folder>
    </ContainedFolders>
</Drive>";


XDocument document = XDocument.Parse(xml);
IList<string> filePaths = document.Descendants("File").Select(GetFullPath).ToList();

<Registry>
        <RootKey>
          <Name>HKEY_LOCAL_MACHINE</Name>
          <Action>None</Action>
          <ContainedKeys>
            <Key>
              <Name>SOFTWARE</Name>
              <Action>None</Action>
              <ContainedKeys>
                <Key>
                  <Name>Classes</Name>
                  <Action>None</Action>
                  <ContainedKeys>
                    <Key>
                      <Name>Installer</Name>
                      <Action>None</Action>
                      <ContainedKeys>
                        <Key>
                          <Name>Features</Name>
                          <Action>None</Action>
                          <ContainedKeys>
                            <Key>
                              <Name>8CD5D2FB0DBCDD64A8D2AB1D09CAF271</Name>
                              <Action>Created</Action>
                              <ContainedValues>
                                <Value>
                                  <Name>ClientPrograms</Name>
                                  <Action>Created</Action>
                                  <After>
                                    <Data>
                                      <Type>REG_SZ</Type>
                                      <Contents></Contents>
                                    </Data>
                                  </After>
                                </Value>
                                <Value>
                                  <Name>DataFiles</Name>
                                  <Action>Created</Action>
                                  <After>
                                    <Data>
                                      <Type>REG_SZ</Type>
                                      <Contents>Server</Contents>
                                    </Data>
                                  </After>
                                </Value>

<pre

     IList<string> Regs = document.Descendants("Value").Select(GetFullPathtoKey).ToList();
        

         static string GetFullPathtoKey(XElement fileElement)
        {
            var names = new HashSet<XName> { "RootKey", "Key", "Value","Type", "Name", "Data", "Contents" };

            IEnumerable<string> pathParts = fileElement.AncestorsAndSelf()
           .Where(el => names.Contains(el.Name))
           .Select(el => (string)el.Element("Name"))
           .Reverse();
            return string.Join("\\", pathParts);
        }

<pre lang="text">

, it will just not work:
Like:

C#

<pre
   IList<string> Regs = document.Descendants("Data").Select(GetFullPathtoKey).ToList();
        

      

         static string GetFullPathtoKey(XElement fileElement)
        {
            var names = new HashSet<XName> { "RootKey", "Key", "Value","Type", "Name", "Data", "Contents" };

            IEnumerable<string> pathParts = fileElement.AncestorsAndSelf()
           .Where(el => names.Contains(el.Name))
           .Select(el => (string)el.Element("Contents"))
           .Reverse();
            return string.Join("\\", pathParts);
        }

<pre lang="text">

will give \\\\\\\\ for the first entry and
\\\\\\\Server for the second.


No I can create three lists for the path with Value, the Action and the Content, but that seems to be overkill.

After extracting the Path: "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8CD5D2FB0DBCDD64A8D2AB1D09CAF271\ClientPrograms"

how can I derive easily the Action, Type and the Content???

I have been piddling with this for the whole weekend without success. I guess I do not understand what the difference is
between the path to <value> and the path to .

Thanks a lot for any help!!!!

static string GetFullPathToKey(XElement dataElement)
{
    var names = new HashSet<XName> { "RootKey", "Key", "Value", "Data" };

    IEnumerable<string> pathParts = dataElement.AncestorsAndSelf()
        .Where(el => names.Contains(el.Name))
        .Select(el => (string)el.Element("Name") ?? (string)el.Element("Contents"))
        .Reverse();

    return string.Join("\\", pathParts);
}

IList<string> Regs = document.Descendants("Data").Select(GetFullPathToKey).ToList();
/*
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8CD5D2FB0DBCDD64A8D2AB1D09CAF271\ClientPrograms\ 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8CD5D2FB0DBCDD64A8D2AB1D09CAF271\DataFiles\Server 
*/

static string GetFullPathToKey(XElement dataElement)
{
    var names = new HashSet<XName> { "RootKey", "Key", "Value" };

    IEnumerable<string> pathParts = dataElement.AncestorsAndSelf()
        .Where(el => names.Contains(el.Name))
        .Select(el => (string)el.Element("Name"))
        .Reverse();

    string fullPath = string.Join("\\", pathParts);

    string details = string.Format(" {{ Action: '{0}', Type: '{1}', Contents: '{2}' }}",
        (string)dataElement.Element("Action"),
        (string)dataElement.Elements("After").Elements("Data").Elements("Type").FirstOrDefault(),
        (string)dataElement.Elements("After").Elements("Data").Elements("Contents").FirstOrDefault());

    return fullPath + details;
}

IList<string> Regs = document.Descendants("Value").Select(GetFullPathToKey).ToList();
/*
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8CD5D2FB0DBCDD64A8D2AB1D09CAF271\ClientPrograms { Action: 'Created', Type: 'REG_SZ', Contents: '' } 
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8CD5D2FB0DBCDD64A8D2AB1D09CAF271\DataFiles { Action: 'Created', Type: 'REG_SZ', Contents: 'Server' }
*/

eblaschka wrote:

this is the output of a disk analysis tool, that I need a human (management ) readable report of.

static string GetFullPath(XElement fileElement)
{
    var names = new HashSet<XName> { "Drive", "Folder", "File" };

    IEnumerable<string> pathParts = fileElements.AncestorsAndSelf()
        .TakeWhile(el => el.Name != "Drives") // Stop when you reach the <Drives> node
        .Where(el => names.Contains(el.Name))
        .Select(el => (string)el.Element("Name"))
        .Reverse();

    return string.Join("\\", pathParts);
}

Jassim Rahma wrote:

the windows services will not run because his PC is switched off