We should clarify the annotations on the Byte_Runs elements in the Windows Registry Key Object. In particular, we should point out that that these are intended for capturing the raw representation of a registry key/value on disk, and not the "logical" raw value as gleaned from some tool such as RegEdit, etc.
We should clarify the annotations on the Byte_Runs elements in the Windows Registry Key Object. In particular, we should point out that that these are intended for capturing the raw representation of a registry key/value on disk, and not the "logical" raw value as gleaned from some tool such as RegEdit, etc.