Duplicate results, if registry backups exist in RegBack

[falklindner]

If there are Registry Backups present in sysvol/windows/system32/config/RegBack, some plugins will display duplicated or outdated results, if they use target.registry.keys("xxx") to load the registry keys holding certain information.

This can be mitigated after parsing by invoking by removing them using the filepath:

key_list = list(self.target.registry.keys(KEYS))

key_list_filtered = [ key for key in key_list if not hasattr(key.hive, "filepath") or "RegBack" not in key.hive.filepath.parts ]

Ideally though, skipping RegBack could be enabled at the keys method.

[Schamper]

Ideally though, skipping RegBack could be enabled at the keys method.

I think a better approach is for it to be user toggle-able somehow. Maybe through an environment variable or a command line argument (--ignore-regback). I don't think we'd want this to be hardcoded in a plugin.

[falklindner-dev]

Would you imagine thes CLI argument to be available for target-query and target-reg. Are there additional commands you'd see the need for that?

[Schamper]

I think ideally there's a common way we can set flags on a Target object (i.e. Target.props), and every CLI tool just uses that (like we already have common argument parsers for BitLocker and LUKS keys.