Skip to content

Commit

Permalink
Address feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
atcuno committed Oct 23, 2024
1 parent 7ea01d1 commit 641955b
Showing 1 changed file with 13 additions and 6 deletions.
19 changes: 13 additions & 6 deletions volatility3/framework/plugins/windows/mftscan.py
Original file line number Diff line number Diff line change
Expand Up @@ -105,9 +105,7 @@ def enumerate_mft_records(
# There is no field that has a count of Attributes
# Keep Attempting to read attributes until we get an invalid attr_header.AttrType
while attr.Attr_Header.AttrType.is_valid_choice:
yield from attr_callback(
record_map, mft_record, attr, symbol_table
)
yield from attr_callback(record_map, mft_record, attr, symbol_table)

# If there's no advancement the loop will never end, so break it now
if attr.Attr_Header.Length == 0:
Expand Down Expand Up @@ -271,7 +269,10 @@ def parse_data_records(

def _generator(self):
for record in self.enumerate_mft_records(
self.context, self.config_path, self.config["primary"], self.parse_mft_records
self.context,
self.config_path,
self.config["primary"],
self.parse_mft_records,
):
yield record

Expand Down Expand Up @@ -352,7 +353,10 @@ def _generator(self):
ads_name,
content,
) in MFTScan.enumerate_mft_records(
self.context, self.config_path, self.config["primary"], self.parse_ads_data_records
self.context,
self.config_path,
self.config["primary"],
self.parse_ads_data_records,
):
yield (
0,
Expand Down Expand Up @@ -418,7 +422,10 @@ def _generator(self):
_,
content,
) in MFTScan.enumerate_mft_records(
self.context, self.config_path, self.config["primary"], self.parse_first_data_records
self.context,
self.config_path,
self.config["primary"],
self.parse_first_data_records,
):
yield (0, (offset, rec_type, rec_num, attr_type, file_name, content))

Expand Down

0 comments on commit 641955b

Please sign in to comment.