Added capacity to extract registry keys and their values to their RegistryExtractor module - Githubissues

CTM1 / win_ewf_extract

A Python framework for extracting artifacts from Windows Encase Disk Images

The Unlicense

0 stars 0 forks source link

Added capacity to extract registry keys and their values to their RegistryExtractor module #5

Closed CTM1 closed 1 year ago

CTM1 commented 1 year ago

Features:

Added a function to parse keys to extract from config
Now extracts the keys from the hive files using python-registry
Writes key, value and create date to .csv
Added more example config files to the repository

Fixes:

Fixed RegistryExtractor not being a subclass of ArtifactExtractor (thx @0x0r10n)
Files are now overwritten when extracting twice instead of being duplicated
Moved the default configs to a config folder instead of source