diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index f50801c70..6aa0142c0 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -112,7 +112,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mft_object_type_name, offset=offset, layer_name=layer.name, - symbol_table_name=symbol_table_name, ) yield mft_record diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 4c5be81ee..8f994752a 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -20,21 +20,15 @@ class MFTEntry(objects.StructType): object_info: interfaces.objects.ObjectInformation, size: int, members: Dict[str, Tuple[int, interfaces.objects.Template]], - **kwargs, ) -> None: super().__init__(context, type_name, object_info, size, members) - self._symbol_table_name = kwargs.get("symbol_table_name") self._attrs_loaded = False self._attrs: List[MFTAttribute] = [] @property def symbol_table_name(self) -> str: - if self._symbol_table_name is None: - raise ValueError( - "MFTEntry was instantiated without an MFT symbol table name" - ) - return self._symbol_table_name + return self.vol.type_name.split(constants.BANG)[0] def get_signature(self) -> objects.String: signature = self.Signature.cast("string", max_length=4, encoding="latin-1")