From 3a591688a61a6ef16cb0a3eb0012a2e405ca5494 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 11 Nov 2017 15:34:06 +0000 Subject: [PATCH] Add in a little more information about signatures. --- volatility/framework/layers/registry.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 185d4f92a..410aac652 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -78,8 +78,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): elif signature == 'vk': return cell.u.KeyValue elif signature == 'db': + # Big Data return cell.u.ValueData elif signature == 'lf' or signature == 'lh' or signature == 'ri': + # Fast Leaf, Hash Leaf, Index Root return cell.u.KeyIndex else: # It doesn't matter that we use KeyNode, we're just after the first two bytes