From 95c468c4f8aeaa00e658901ee1bd23054756d8a2 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 12 Oct 2023 10:16:56 -0500 Subject: [PATCH 1/2] issue #1019 - for subkeys, return the modified time of the subkey itself, not its parent key --- volatility3/framework/plugins/windows/registry/printkey.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 537bfc943..70a288b63 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -153,6 +153,9 @@ class PrintKey(interfaces.plugins.PluginInterface): vollog.debug(excp) key_node_name = renderers.UnreadableValue() + # if the item is a subkey, use the LastWriteTime of that subkey + last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) + yield ( depth, ( From a497216bebd8e5a9d3ebe4fd039b673d90346ce7 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 18 Oct 2023 14:09:42 -0500 Subject: [PATCH 2/2] issue #1019 - black updates --- volatility3/framework/plugins/windows/registry/printkey.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 70a288b63..f66e55f4b 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -154,7 +154,9 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node_name = renderers.UnreadableValue() # if the item is a subkey, use the LastWriteTime of that subkey - last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) + last_write_time = conversion.wintime_to_datetime( + node.LastWriteTime.QuadPart + ) yield ( depth,