From ebbbe913dc92d609b8315a9d1761ee8eab8791d5 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Thu, 3 Apr 2025 17:55:28 -0500
Subject: [PATCH] Convert remaining values to Python primitives

---
 .../framework/plugins/windows/mftscan.py      | 37 +++++++++++++++----
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py
index 7df895f15..cb4b880d5 100644
--- a/volatility3/framework/plugins/windows/mftscan.py
+++ b/volatility3/framework/plugins/windows/mftscan.py
@@ -224,11 +224,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
             self.config_path,
             self.config["primary"],
         ):
+            # Convert all `objects.PrimitiveObject` to their simpler Python
+            # types. This is normally not something we would do, since it's
+            # lossy and prevents users from getting back to the data source,
+            # but in this case memory usage is so extreme due to the number of
+            # records that it becomes necessary. The rich types are still
+            # exposed through classmethods.
             yield level, (
                 record.offset,
                 record.record_type,
-                record.record_number,
-                record.link_count,
+                int(record.record_number),
+                int(record.link_count),
                 record.mft_type,
                 record.permissions,
                 record.attribute_type,
@@ -341,12 +347,16 @@ class ADS(interfaces.plugins.PluginInterface):
             self.config["primary"],
         ):
             for record in self.parse_ads_data_records(mft_entry):
-                # Convert to basic strings here __only__ because they'll use so
-                # much memory in the tree otherwise.
+                # Convert all `objects.PrimitiveObject` to their simpler Python
+                # types. This is normally not something we would do, since it's
+                # lossy and prevents users from getting back to the data source,
+                # but in this case memory usage is so extreme due to the number of
+                # records that it becomes necessary. The rich types are still
+                # exposed through classmethods.
                 yield 0, (
                     record.offset,
-                    record.signature,
-                    record.record_number,
+                    str(record.signature),
+                    int(record.record_number),
                     record.attribute_type,
                     (
                         str(record.filename)
@@ -447,7 +457,20 @@ class ResidentData(interfaces.plugins.PluginInterface):
         ):
             resident_data_entry = self.parse_resident_data(mft_record)
             if resident_data_entry:
-                yield 0, resident_data_entry
+                # Convert all `objects.PrimitiveObject` to their simpler Python
+                # types. This is normally not something we would do, since it's
+                # lossy and prevents users from getting back to the data source,
+                # but in this case memory usage is so extreme due to the number of
+                # records that it becomes necessary. The rich types are still
+                # exposed through classmethods.
+                yield 0, (
+                    resident_data_entry.offset,
+                    resident_data_entry.signature,
+                    int(resident_data_entry.record_number),
+                    resident_data_entry.attribute_type,
+                    str(resident_data_entry.filename),
+                    resident_data_entry.content,
+                )
 
     def run(self):
         return renderers.TreeGrid(