From 3363962d648ea8d59a49599d94b399ba64ad9305 Mon Sep 17 00:00:00 2001
From: Jeffrey <9938813+Raphire@users.noreply.github.com>
Date: Sun, 17 May 2026 20:13:48 +0200
Subject: [PATCH] Add back support for REG_MULTI_SZ in Convert-RegValueData

---
 Scripts/Helpers/Get-RegFileOperations.ps1 | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/Scripts/Helpers/Get-RegFileOperations.ps1 b/Scripts/Helpers/Get-RegFileOperations.ps1
index b808c44..e3dea03 100644
--- a/Scripts/Helpers/Get-RegFileOperations.ps1
+++ b/Scripts/Helpers/Get-RegFileOperations.ps1
@@ -113,14 +113,11 @@ function Convert-RegValueData {
     }
 
     if ($valueData -match '^hex(?:\((?<kind>[0-9a-fA-F]+)\))?:(?<bytes>[0-9a-fA-F,\s]+)$') {
-        if ($matches.kind -eq '7') {
-            throw "Unsupported registry value type hex(7) (REG_MULTI_SZ) encountered."
-        }
-
         $bytes = Convert-HexStringToByteArray -hexValue $matches.bytes
         $valueType = if ($matches.kind) { "Hex$($matches.kind)" } else { 'Binary' }
         $value = switch ($matches.kind) {
             '2' { Convert-RegistryByteArrayToString -byteData $bytes }
+            '7' { Convert-RegistryByteArrayToMultiString -byteData $bytes }
             default { $bytes }
         }
 
@@ -166,3 +163,12 @@ function Convert-RegistryByteArrayToString {
 
     return ([System.Text.Encoding]::Unicode.GetString($byteData)).TrimEnd([char]0)
 }
+
+function Convert-RegistryByteArrayToMultiString {
+    param(
+        [Parameter(Mandatory)]
+        [byte[]]$byteData
+    )
+
+    return @(([System.Text.Encoding]::Unicode.GetString($byteData)).TrimEnd([char]0) -split "`0" | Where-Object { $_ -ne '' })
+}