From 497f0f4950e5071a935163dee0c83eca8006116a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 8 Nov 2017 11:40:17 +0000 Subject: [PATCH] Registry node with RI signature are effectively _CM_KEY_INDEX, just with single item elements. --- volatility/framework/layers/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index e947392cb..1a06038d7 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -77,7 +77,7 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): return cell.u.KeyValue elif signature == 'db': return cell.u.ValueData - elif signature == 'lf' or signature == 'lh': + elif signature == 'lf' or signature == 'lh' or signature == 'ri': return cell.u.KeyIndex else: # It doesn't matter that we use KeyNode, we're just after the first two bytes