dissect.target 3.9.dev17__tar.gz → 3.9.dev18__tar.gz

{dissect.target-3.9.dev17/dissect.target.egg-info → dissect.target-3.9.dev18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev17
+Version: 3.9.dev18
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev17 → dissect.target-3.9.dev18}/dissect/target/plugins/os/windows/registry.py

@@ -98,6 +98,10 @@ class RegistryPlugin(Plugin):
             if not bcd.exists():
                 continue
 
+            if bcd.stat().st_size == 0:
+                self.target.log.warning("Empty BCD hive: %s", bcd)
+                continue
+
             try:
                 hf = RegfHive(bcd)
                 self.add_hive("BCD", hf, bcd)
@@ -116,7 +120,11 @@ class RegistryPlugin(Plugin):
             user = user_details.user
             ntuser = user_details.home_path.joinpath("ntuser.dat")
 
-            if ntuser.exists():
+            if not ntuser.exists():
+                self.target.log.debug("Could not find ntuser.dat: %s", ntuser)
+            elif ntuser.stat().st_size == 0:
+                self.target.log.warning("Empty NTUSER.DAT hive: %s", ntuser)
+            else:
                 try:
                     ntuserhive = RegfHive(ntuser)
                     self.add_hive(user.sid, ntuserhive, ntuser)
@@ -126,11 +134,14 @@ class RegistryPlugin(Plugin):
                     self._hives_to_users[ntuserhive] = user_details
                 except Exception as e:
                     self.target.log.warning("Could not open ntuser.dat: %s", ntuser, exc_info=e)
-            else:
-                self.target.log.debug("Could not find ntuser.dat: %s", ntuser)
 
             usrclass = user_details.home_path.joinpath("AppData/Local/Microsoft/Windows/usrclass.dat")
-            if usrclass.exists():
+
+            if not usrclass.exists():
+                self.target.log.debug("Could not find usrclass.dat: %s", usrclass)
+            elif usrclass.stat().st_size == 0:
+                self.target.log.warning("Empty UsrClass.DAT hive: %s", usrclass)
+            else:
                 try:
                     usr_class_hive = RegfHive(usrclass)
                     self.add_hive(f"{user.sid}_Classes", usr_class_hive, usrclass)
@@ -140,8 +151,6 @@ class RegistryPlugin(Plugin):
                     self._hives_to_users[usr_class_hive] = user_details
                 except Exception as e:
                     self.target.log.warning("Could not open usrclass.dat: %s", usrclass, exc_info=e)
-            else:
-                self.target.log.debug("Could not find usrclass.dat: %s", usrclass)
 
         self._users_loaded = True
 

{dissect.target-3.9.dev17 → dissect.target-3.9.dev18/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.9.dev17
+Version: 3.9.dev18
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.9.dev17 → dissect.target-3.9.dev18}/dissect.target.egg-info/SOURCES.txt

@@ -364,6 +364,7 @@ tests/test_plugins_os_windows_regf_clsid.py
 tests/test_plugins_os_windows_regf_muicache.py
 tests/test_plugins_os_windows_regf_trusteddocs.py
 tests/test_plugins_os_windows_regf_userassist.py
+tests/test_plugins_os_windows_registry.py
 tests/test_plugins_os_windows_sam.py
 tests/test_plugins_os_windows_shimcache.py
 tests/test_plugins_os_windows_sru.py

dissect.target-3.9.dev18/tests/test_plugins_os_windows_registry.py

@@ -0,0 +1,67 @@
+import logging
+from io import BytesIO
+
+from pytest import LogCaptureFixture
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.windows.registry import RegistryPlugin
+from dissect.target.target import Target
+
+
+def test_missing_hives(fs_win: VirtualFilesystem, caplog: LogCaptureFixture):
+    target = Target()
+    target.filesystems.add(fs_win)
+
+    caplog.set_level(logging.DEBUG)
+    target.apply()
+
+    expected = [
+        f"{target}: Could not find hive: sysvol/windows/system32/config/{hive}" for hive in RegistryPlugin.SYSTEM
+    ]
+    expected += [
+        f"{target}: Could not find hive: sysvol/windows/system32/config/RegBack/{hive}"
+        for hive in RegistryPlugin.SYSTEM
+    ]
+
+    assert [record.message for record in caplog.records if record.filename == "registry.py"] == expected
+
+
+def test_missing_user_hives(fs_win: VirtualFilesystem, target_win_users: Target, caplog: LogCaptureFixture):
+    fs_win.makedirs("Users/John")
+
+    caplog.set_level(logging.DEBUG)
+    target_win_users.registry.load_user_hives()
+
+    assert [record.message for record in caplog.records if record.filename == "registry.py"] == [
+        f"{target_win_users}: Could not find ntuser.dat: C:/Users/John/ntuser.dat",
+        f"{target_win_users}: Could not find usrclass.dat: C:/Users/John/AppData/Local/Microsoft/Windows/usrclass.dat",
+    ]
+
+
+def test_empty_hives(fs_win: VirtualFilesystem, caplog: LogCaptureFixture):
+    fs_win.map_file_fh("windows/system32/config/SYSTEM", BytesIO())
+    fs_win.map_file_fh("boot/BCD", BytesIO())
+
+    target = Target()
+    target.filesystems.add(fs_win)
+
+    caplog.set_level(logging.WARNING)
+    target.apply()
+
+    assert [record.message for record in caplog.records if record.filename == "registry.py"] == [
+        f"{target}: Empty hive: sysvol/windows/system32/config/SYSTEM",
+        f"{target}: Empty BCD hive: sysvol/boot/BCD",
+    ]
+
+
+def test_empty_user_hives(fs_win: VirtualFilesystem, target_win_users: Target, caplog: LogCaptureFixture):
+    fs_win.map_file_fh("Users/John/ntuser.dat", BytesIO())
+    fs_win.map_file_fh("Users/John/AppData/Local/Microsoft/Windows/usrclass.dat", BytesIO())
+
+    caplog.set_level(logging.WARNING)
+    target_win_users.registry.load_user_hives()
+
+    assert [record.message for record in caplog.records if record.filename == "registry.py"] == [
+        f"{target_win_users}: Empty NTUSER.DAT hive: C:/Users/John/ntuser.dat",
+        f"{target_win_users}: Empty UsrClass.DAT hive: C:/Users/John/AppData/Local/Microsoft/Windows/usrclass.dat",
+    ]