Changes for mapping Windows XP UsrClass.dat (#221)

log2timeline · Feb 23, 2024 · 05ea811 · 05ea811
1 parent d4cbc54
commit 05ea811
Show file tree

Hide file tree

Showing 5 changed files with 8 additions and 6 deletions.
diff --git a/.github/workflows/test_docker.yml b/.github/workflows/test_docker.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: ['38']
+        version: ['39']
     container:
       image: registry.fedoraproject.org/fedora:${{ matrix.version }}
     steps:

diff --git a/config/dpkg/changelog b/config/dpkg/changelog
@@ -1,5 +1,5 @@
-dfwinreg (20240210-1) unstable; urgency=low
+dfwinreg (20240223-1) unstable; urgency=low
 
   * Auto-generated
 
- -- Log2Timeline maintainers <[email protected]>  Sat, 10 Feb 2024 07:50:58 +0100
+ -- Log2Timeline maintainers <[email protected]>  Fri, 23 Feb 2024 06:25:43 +0100
diff --git a/dfwinreg/__init__.py b/dfwinreg/__init__.py
@@ -5,4 +5,4 @@
 provides read-only access to Windows Registry objects.
 """
 
-__version__ = '20240210'
+__version__ = '20240223'
diff --git a/dfwinreg/registry.py b/dfwinreg/registry.py
@@ -55,15 +55,17 @@ class WinRegistry(object):
           '%UserProfile%\\NTUSER.DAT',
           ['\\AppEvents', '\\Console', '\\Control Panel', '\\Environment',
            '\\Keyboard Layout', '\\Software']),
+      # Windows Vista and later UsrClass.dat mapping
       WinRegistryFileMapping(
           'HKEY_CURRENT_USER\\Software\\Classes',
           '%UserProfile%\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat',
           ['\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion']),
+      # Windows 2000, XP and 2003 UsrClass.dat mapping
       WinRegistryFileMapping(
           'HKEY_CURRENT_USER\\Software\\Classes',
           ('%UserProfile%\\Local Settings\\Application Data\\Microsoft\\'
            'Windows\\UsrClass.dat'),
-          []),
+          ['\\Software\\Microsoft\\Windows\\CurrentVersion']),
       WinRegistryFileMapping(
           'HKEY_LOCAL_MACHINE\\SAM',
           '%SystemRoot%\\System32\\config\\SAM',

diff --git a/setup.cfg b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = dfwinreg
-version = 20240210
+version = 20240223
 description = Digital Forensics Windows Registry (dfWinReg).
 long_description = dfWinReg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects. The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
 long_description_content_type = text/plain