From 2d408491bd246d9dab5276ecf77c38fe66e9d439 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 15 Jan 2020 02:19:12 +0000 Subject: [PATCH] Printkey: Slightly improve subkey name determination. --- volatility/framework/plugins/windows/registry/printkey.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index ee4347833..eb420f4e1 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -61,9 +61,9 @@ class PrintKey(interfaces.plugins.PluginInterface): vollog.warning("Hive walker was not passed a valid node_path (or None)") return node = node_path[-1] + key_path = '\\'.join([k.get_name() for k in node_path]) if node.vol.type_name.endswith(constants.BANG + '_CELL_DATA'): raise RegistryFormatException(hive.name, "Encountered _CELL_DATA instead of _CM_KEY_NODE") - key_path = node.get_key_path() last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) for key_node in node.get_subkeys():