From 18f1e5ae90e340e2600f63566a2a57ef8b60b327 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 10 Nov 2017 18:08:06 +0000 Subject: [PATCH] Re-order the output of the printkey plugin. --- volatility/plugins/windows/printkey.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility/plugins/windows/printkey.py b/volatility/plugins/windows/printkey.py index 3ac7e4237..6f61c1060 100644 --- a/volatility/plugins/windows/printkey.py +++ b/volatility/plugins/windows/printkey.py @@ -43,9 +43,9 @@ class PrintKey(plugins.PluginInterface): for key_node in node.get_subkeys(): result = (key_path.count("\\"), - (key_path, - str(datetime.datetime.utcfromtimestamp(unix_time)), + (str(datetime.datetime.utcfromtimestamp(unix_time)), "Key", + key_path, key_node.helper_name, "", key_node.helper_volatile)) @@ -53,9 +53,9 @@ class PrintKey(plugins.PluginInterface): for value_node in node.get_values(): result = (key_path.count("\\"), - (key_path, - str(datetime.datetime.utcfromtimestamp(unix_time)), + (str(datetime.datetime.utcfromtimestamp(unix_time)), RegValueTypes(value_node.Type).name, + key_path, value_node.helper_name, str(value_node.decode_data()), node.helper_volatile)) @@ -80,9 +80,9 @@ class PrintKey(plugins.PluginInterface): if self.config.get('key', None): node = registry_layer.get_key(self.config['key']) - return TreeGrid(columns = [('Key', str), - ('Last Write Time', str), + return TreeGrid(columns = [('Last Write Time', str), ('Type', str), + ('Key', str), ('Name', str), ('Data', str), ('Volatile', bool)],