dissect.target icon indicating copy to clipboard operation
dissect.target copied to clipboard
verified publisher icon fox-it

Make `RegistryRecordDescriptorExtension` populate `source` field

Open JSCU-CNI opened this issue 5 months ago • 1 comments

Currently RegistryRecordDescriptorExtension populates the string fields regf_key_path and regf_hive_path. This should be extended to populate the source path field.

The source field could be populated using the abbreviated name of the registry hive - if available - e.g. HKLM\\SOFTWARE\\Foo\\Bar.

JSCU-CNI avatar Jul 21 '25 09:07 JSCU-CNI

Hi @JSCU-CNI , since the source and path fields can be intertwined, can you say from your perspective what values would you like in each? Can you please provide more examples?

EinatFox avatar Aug 18 '25 13:08 EinatFox