WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 19:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Address feedback

Browse Source
This commit is contained in:
Andrew Case
2024-10-15 14:12:23 -05:00
parent 79f81f0af9
commit adee265b17
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/mftscan.py
+13 -6
View File
@@ -105,9 +105,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
# There is no field that has a count of Attributes
# Keep Attempting to read attributes until we get an invalid attr_header.AttrType
while attr.Attr_Header.AttrType.is_valid_choice:
yield from attr_callback(
record_map, mft_record, attr, symbol_table
)
yield from attr_callback(record_map, mft_record, attr, symbol_table)
# If there's no advancement the loop will never end, so break it now
if attr.Attr_Header.Length == 0:
@@ -271,7 +269,10 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
def _generator(self):
for record in self.enumerate_mft_records(
self.context, self.config_path, self.config["primary"], self.parse_mft_records
self.context,
self.config_path,
self.config["primary"],
self.parse_mft_records,
):
yield record
@@ -352,7 +353,10 @@ class ADS(interfaces.plugins.PluginInterface):
ads_name,
content,
) in MFTScan.enumerate_mft_records(
self.context, self.config_path, self.config["primary"], self.parse_ads_data_records
self.context,
self.config_path,
self.config["primary"],
self.parse_ads_data_records,
):
yield (
0,
@@ -418,7 +422,10 @@ class ResidentData(interfaces.plugins.PluginInterface):
_,
content,
) in MFTScan.enumerate_mft_records(
self.context, self.config_path, self.config["primary"], self.parse_first_data_records
self.context,
self.config_path,
self.config["primary"],
self.parse_first_data_records,
):
yield (0, (offset, rec_type, rec_num, attr_type, file_name, content))