ikelos and GitHub
b3d1ce319c
Merge pull request #1758 from volatilityfoundation/bugfix/mftscan_memory_usage
...
Windows MFTScan: Memory usage performance fixes
2025-04-07 14:53:29 +01:00
David McDonald
39b3e76efc
Add a filename to STANDARD_INFORMATION timeline entries
2025-04-04 17:46:46 -05:00
David McDonald
a0ca33b284
Also yield STANDARD_INFORMATION timestamps in timeliner
2025-04-04 11:30:27 -05:00
David McDonald
b15e9104e8
Rename methods, add docstrings
...
Improves the naming of a couple of the new extension class methods to
more accurately reflect the return type, and adds docstrings to
extensions class methods.
2025-04-04 10:32:13 -05:00
David McDonald
8428e81f03
Fix up remaining type-hints
...
Updates type hints on some fields of the result namedtuples to be their
`objects.Primitive` types instead of Python primitives, and does any
conversion to Python primitives in the generator methods.
2025-04-04 10:30:46 -05:00
David McDonald
a5dfc6acb3
Bump required framework version on all three MFTScan plugins
2025-04-03 18:06:23 -05:00
David McDonald
de117042fe
Remove symbol_table_name from object constructor
...
Get from `self.vol.type_name` instead
2025-04-03 18:04:43 -05:00
David McDonald
41de562e55
Revert "Add versioning to MFT extension classes"
...
This reverts commit 1d20e65759
2025-04-03 17:56:16 -05:00
David McDonald
ebbbe913dc
Convert remaining values to Python primitives
2025-04-03 17:55:42 -05:00
David McDonald
1d20e65759
Add versioning to MFT extension classes
2025-04-03 17:39:14 -05:00
David McDonald
8b308133f5
Bump required version numbers
2025-04-03 17:32:25 -05:00
David McDonald
9f85e1465e
Major version bumps for all three plugins
2025-04-03 17:19:17 -05:00
David McDonald
5fda7409eb
Log InvalidAddressException instances
2025-04-03 17:18:20 -05:00
David McDonald
41cf17ed65
Refactor: Ditch dictionary usage, eliminate callbacks
...
This simplifies the design of these plugins by moving as much MFTEntry
specific data into the extension class (caching attributes, since
they'll need to be accessed repeatedly) and moving away from the
callback-based implementation to one where classmethods consume
`mft.MFTEntry` objects in order to produce their values.
These changes do two important things:
- They allow us to preserve `object.String` objects until the generator
function, which makes the public interface much better since people
can navigate back the the source of the data within their context
- Completely eliminates the `record_map` that was causing so much memory
consumption.
2025-04-03 17:18:20 -05:00
David McDonald
43e6fefe39
Add attribute iterator to MFTEntry extension class
2025-04-03 11:33:56 -05:00
ikelos and GitHub
6ddb0fef29
Merge pull request #1748 from eve-mem/volshell_display_types_pointer_upgrade_2025
...
Volshell: Display types pointer upgrade
2025-04-03 17:21:30 +01:00
Mike Auty
338c76c2ca
Documentation: Add in @dgmcdonna suggestions/corrections
2025-04-03 17:08:13 +01:00
Mike Auty
3b21b350f1
Documentation: Add in a small section on the coding style about using f-string modifiers over separate calls
2025-04-03 17:04:18 +01:00
eve
69e3c7d9ae
Volshell: use built in formatting rather than hex() function
2025-04-03 17:01:21 +01:00
Eve and GitHub
61c67b63d4
Merge branch 'develop' into volshell_display_types_pointer_upgrade_2025
2025-04-03 16:54:28 +01:00
eve
86945492a7
Volshell: display if embedded struct offest is unreadable in dt output
2025-04-03 16:49:27 +01:00
David McDonald
4492da0263
Create attribute iterator method
...
Moves logic for iterating through `MFTEntry` attributes into a new
`attributes()` method on the extension class.
2025-04-03 10:40:05 -05:00
eve
b1c1645657
volshell: inform user that value displayed is only an offset for types like embedded structs
2025-04-03 16:38:55 +01:00
Mike Auty
ed1b1f5369
Avoid bumping the version too quickly without reason
2025-04-03 16:30:25 +01:00
Mike Auty
b01c17f419
CLI: Fix bad typing issue in pretty printer
...
Fixes #1759
2025-04-03 16:24:47 +01:00
David McDonald
e84036c5a6
Add missing 'e' to variable names
2025-04-03 10:02:08 -05:00
57524edb87
Remove unnecessary quotes from type hints
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-04-03 09:58:35 -05:00
David McDonald
86c5c16ed6
Windows MFTScan Plugins: Performance fixes
...
There was a subtle issue that was causing substantial performance issues
in the MFTScan plugins. The `record_map` was purportedly of type
`Dict[str, Tuple[int, str, int]]`, but in reality, the second member was
a list, and its `str` item was actually being populated with unprocessed
values from method calls on the MFT extension classes, which actually
return `object.String`. These objects are substantially larger than
basic `str` types:
```
[ins] In [5]: pympler.asizeof.asizeof(rec_name)
Out[5]: 312648
[ins] In [6]: pympler.asizeof.asizeof(str(rec_name))
Out[6]: 64
```
This caused this dictionary to grow in size to several gigabytes on
larger samples, resulting in thrashing and OOM errors.
2025-04-02 15:46:47 -05:00
David McDonald
3c3b2b3bbd
MFT Extensions: Fix type hints
...
These type hints are a bit misleading, and have been updated to reflect
their real return type.
2025-04-02 15:16:15 -05:00
ikelos and GitHub
0fb721e219
Merge pull request #1757 from volatilityfoundation/fix_tests
...
Tests: Fix Userassist and MFTScan testdata
2025-04-02 21:04:46 +01:00
David McDonald
5befbf8629
Tests: Fix MFTScan testdata
...
These test values needed updating now that the `LayerData` type is used
and presents the data a little differently than before.
2025-04-02 14:08:18 -05:00
David McDonald
e446c1081d
Remove debugging call
2025-04-02 09:43:20 -05:00
David McDonald
0b1bbb87ee
Windows Tests: Update userassist JSON output
...
The new layer data type renders the output a little differently, and the
plugin also seems to render 'N/A' for a missing value where previously
it was an empty string.
2025-04-02 09:36:07 -05:00
Mike Auty
d3d19fe776
CLI: Handle BaseAbsentValues in JSON
2025-04-01 23:38:05 +01:00
Mike Auty
aad6a56336
Fix old typing mechanism
2025-04-01 23:20:49 +01:00
Mike Auty
e2fb96a0d3
Fix up JSON rendering of hex bytes and LayerData
2025-04-01 23:14:03 +01:00
ikelos and GitHub
bb2f28a39e
Update volatility3/cli/volshell/generic.py
2025-04-01 22:29:48 +01:00
Mike Auty
9791ae5878
Fix up direct import issue
2025-04-01 22:23:03 +01:00
ikelos and GitHub
377697cc43
Merge pull request #1622 from volatilityfoundation/feature/data-renderer
...
Feature/data renderer
2025-04-01 22:16:28 +01:00
ikelos and GitHub
e91dfb2673
Merge pull request #1755 from volatilityfoundation/update_and_fix_bugs_check_afinfo
...
Fix several bugs in check_afinfo. Update through latest kernels. Matc…
2025-04-01 22:07:26 +01:00
Andrew Case
caedfc564f
Fix black error
2025-04-01 13:34:24 +00:00
ikelos and GitHub
2ca5fd5fe5
Update volatility3/framework/plugins/linux/check_afinfo.py
...
Fix up ruff error.
2025-04-01 11:22:55 +01:00
9c58cfc2a8
Potential fix for code scanning alert no. 416: Implicit string concatenation in a list
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-04-01 11:20:48 +01:00
Andrew Case
524d89ad6c
Fix several bugs in check_afinfo. Update through latest kernels. Match current Volatility coding standards
2025-03-31 23:08:49 +00:00
ikelos and GitHub
c0aea41168
Merge pull request #1750 from volatilityfoundation/import_checker
...
Testing: Check + fix 'import from' statements
2025-03-29 21:40:22 +00:00
David McDonald
1412004422
Make registry_layers -> registry_layer for consistency
2025-03-29 15:56:25 -05:00
David McDonald
c17bcb644b
Revert changes to intel.py
2025-03-29 15:51:19 -05:00
David McDonald
ee3d965ef6
Revert changes to configuration.py
2025-03-29 15:50:36 -05:00
David McDonald
296cb3c113
Code Analysis: Give pass to 'volatility3'
...
Also moves some code into a private method with a docstring in the
visitor class.
2025-03-29 15:49:33 -05:00
David McDonald
f72b717c00
Comment type annotation to fix circular import
2025-03-29 15:49:33 -05:00
