From 95c468c4f8aeaa00e658901ee1bd23054756d8a2 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 12 Oct 2023 10:16:56 -0500 Subject: [PATCH] issue #1019 - for subkeys, return the modified time of the subkey itself, not its parent key --- volatility3/framework/plugins/windows/registry/printkey.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 537bfc943..70a288b63 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -153,6 +153,9 @@ class PrintKey(interfaces.plugins.PluginInterface): vollog.debug(excp) key_node_name = renderers.UnreadableValue() + # if the item is a subkey, use the LastWriteTime of that subkey + last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) + yield ( depth, (