From 2c73d8812a24eb8e34b84cfc6be61bf06a0c18b5 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 21 Jul 2024 08:55:27 -0500 Subject: [PATCH] Split layer gathering and add KeyError checks --- volatility3/framework/plugins/windows/mftscan.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index e2dfa12a3..6a4033a6f 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -44,7 +44,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ] def enumerate_mft_records(self, attr_callback): - phys_layer = self.context.layers[self.config["primary"]].config["memory_layer"] + try: + primary = self.context.layers[self.config["primary"]] + except KeyError: + vollog.error("Unable to obtain primary layer for scanning. Please file a bug on GitHub about this issue.") + return + + try: + phys_layer = primary.config["memory_layer"] + except KeyError: + vollog.error("Unable to obtain memory layer from primary layer. Please file a bug on GitHub about this issue.") + return layer = self.context.layers[phys_layer]