dfwinreg
dfwinreg copied to clipboard
Digital Forensics Windows Registry (dfWinReg)
add support for HKEY_LOCAL_MACHINE\BCD00000000 The corresponding regf file is typically stored on the boot volume (active partition) under `\Boot\` or `\EFI\Microsoft\Boot\`
Add sanity check if Windows NT SYSTEM Registry file contains CurrentControlSet key
key => directory with name of the key values => sub directory of a directory with name of the key named "(values)" default value => file in sub directory "(values)"...
Currently FindSpecs and WinRegistrySearch are not able to search for Values within a specific key, limiting searches to keys only. The docstring for WinRegistrySearcher is slightly incorrect here as it...
- initially directly map this to HKEY_LOCAL_MACHINE\Software\Classes ? - https://msdn.microsoft.com/en-us/library/windows/desktop/ms724475%28v=vs.85%29.aspx - https://msdn.microsoft.com/en-us/library/windows/desktop/ms724498%28v=vs.85%29.aspx