mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-09 19:27:39 +02:00
issue #1019 - for subkeys, return the modified time of the subkey itself, not its parent key
This commit is contained in:
@@ -153,6 +153,9 @@ class PrintKey(interfaces.plugins.PluginInterface):
|
||||
vollog.debug(excp)
|
||||
key_node_name = renderers.UnreadableValue()
|
||||
|
||||
# if the item is a subkey, use the LastWriteTime of that subkey
|
||||
last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart)
|
||||
|
||||
yield (
|
||||
depth,
|
||||
(
|
||||
|
||||
Reference in New Issue
Block a user