#1471 - add deprecated plugins in old location

volatility3/framework/plugins/windows/amcache.py

@@ -0,0 +1,23 @@
+# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+import warnings
+from volatility3.plugins.windows.registry import amcache
+
+vollog = logging.getLogger(__name__)
+
+
+class Amcache(amcache.Amcache):
+    """Extract information on executed applications from the AmCache (deprecated)."""
+
+    _required_framework_version = (2, 0, 0)
+    _version = (2, 0, 0)
+
+    def __getattr__(self, *args, **kwargs):
+        warnings.warn(
+            DeprecationWarning(
+                "This plugin is now called windows.registry.amcache.Amcache"
+            )
+        )
+        return super().__getattr__(*args, **kwargs)

volatility3/framework/plugins/windows/cachedump.py

@@ -0,0 +1,23 @@
+# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+import warnings
+from volatility3.plugins.windows.registry import cachedump
+
+vollog = logging.getLogger(__name__)
+
+
+class Cachedump(cachedump.Cachedump):
+    """Dumps lsa secrets from memory (deprecated)"""
+
+    _required_framework_version = (2, 0, 0)
+    _version = (1, 0, 2)
+
+    def __getattr__(self, *args, **kwargs):
+        warnings.warn(
+            DeprecationWarning(
+                "This plugin is now called windows.registry.cachedump.Cachedump"
+            )
+        )
+        return super().__getattr__(*args, **kwargs)

volatility3/framework/plugins/windows/hashdump.py

@@ -0,0 +1,23 @@
+# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+import warnings
+from volatility3.plugins.windows.registry import hashdump
+
+vollog = logging.getLogger(__name__)
+
+
+class Hashdump(hashdump.Hashdump):
+    """Dumps user hashes from memory (deprecated)"""
+
+    _required_framework_version = (2, 0, 0)
+    _version = (1, 1, 1)
+
+    def __getattr__(self, *args, **kwargs):
+        warnings.warn(
+            DeprecationWarning(
+                "This plugin is now called windows.registry.hashdump.Hashdump"
+            )
+        )
+        return super().__getattr__(*args, **kwargs)

volatility3/framework/plugins/windows/lsadump.py

@@ -0,0 +1,23 @@
+# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+import warnings
+from volatility3.plugins.windows.registry import lsadump
+
+vollog = logging.getLogger(__name__)
+
+
+class Lsadump(lsadump.Lsadump):
+    """Dumps lsa secrets from memory (deprecated)"""
+
+    _required_framework_version = (2, 0, 0)
+    _version = (1, 0, 1)
+
+    def __getattr__(self, *args, **kwargs):
+        warnings.warn(
+            DeprecationWarning(
+                "This plugin is now called windows.registry.lsadump.Lsadump"
+            )
+        )
+        return super().__getattr__(*args, **kwargs)

volatility3/framework/plugins/windows/scheduled_tasks.py

@@ -0,0 +1,24 @@
+# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0
+# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
+#
+import logging
+import warnings
+from volatility3.plugins.windows.registry import scheduled_tasks
+
+vollog = logging.getLogger(__name__)
+
+
+class ScheduledTasks(scheduled_tasks.ScheduledTasks):
+    """Decodes scheduled task information from the Windows registry, including \
+information about triggers, actions, run times, and creation times (deprecated)."""
+
+    _required_framework_version = (2, 11, 0)
+    _version = (2, 0, 0)
+
+    def __getattr__(self, *args, **kwargs):
+        warnings.warn(
+            DeprecationWarning(
+                "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks"
+            )
+        )
+        return super().__getattr__(*args, **kwargs)