Struct TestingRegistry 

pub struct TestingRegistry {
    pub cell: BTreeMap<String, MountedCell>,
    pub cached: RefCell<BTreeMap<RegHiveKey, String>>,
    pub counter: RefCell<isize>,
}

Basic Registry for testing. Includes the user profile “S-1-5-21-1366093794-4292800403-1155380978-513”

Fields

cell: BTreeMap<String, MountedCell>

cached: RefCell<BTreeMap<RegHiveKey, String>>

counter: RefCell<isize>

Implementations

impl TestingRegistry

pub fn empty() -> Self

pub fn new() -> Self

pub fn increase_counter(&self) -> isize

pub fn add_value(&mut self, path: &str, value: &str, data: RegValue)

pub fn contains(&self, path: &str) -> bool

pub fn get_value(&self, path: &str, value: &str) -> Option<RegValue>

pub fn get_values(&self, path: &str) -> Option<Vec<String>>

pub fn get_keys(&self, path: &str) -> Option<Vec<String>>

Trait Implementations

impl Clone for TestingRegistry

fn clone(&self) -> TestingRegistry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TestingRegistry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TestingRegistry

fn default() -> Self

Returns the “default value” for a type.

impl RegistryReader for TestingRegistry

fn from_file( &self, _file: Box<dyn VirtualFile>, ) -> ForensicResult<Box<dyn RegistryReader>>

Mounts a registry reader in a hive file

fn from_fs( &self, _fs: Box<dyn VirtualFileSystem>, ) -> ForensicResult<Box<dyn RegistryReader>>

The Windows registry consists of numerous hives and we need access to all of them.

fn open_key( &self, hkey: RegHiveKey, key_name: &str, ) -> ForensicResult<RegHiveKey>

Opens a registry key. If the registry reader is a file based one it needs to do the same thing that the Window Kernel does: store a Map with the association of keys with the path they point to.

fn read_value( &self, hkey: RegHiveKey, value_name: &str, ) -> ForensicResult<RegValue>

fn enumerate_values(&self, hkey: RegHiveKey) -> ForensicResult<Vec<String>>

fn enumerate_keys(&self, hkey: RegHiveKey) -> ForensicResult<Vec<String>>

fn key_at(&self, hkey: RegHiveKey, pos: u32) -> ForensicResult<String>

fn value_at(&self, hkey: RegHiveKey, pos: u32) -> ForensicResult<String>

fn key_info(&self, hkey: RegHiveKey) -> ForensicResult<RegistryKeyInfo>

Retrieves information about the key. Emulates RegQueryInfoKey

fn close_key(&self, hkey: RegHiveKey)

Closes a handle to the specified registry key.

fn get_system_root(&self) -> ForensicResult<String>

Get the same value as the env var “%SystemRoot%”“. It’s usually “C:\Windows”

fn list_users(&self) -> ForensicResult<Vec<String>>

fn windows_build(&self) -> ForensicResult<u32>

Get the current build of Windows: See “RTM build” in https://en.wikipedia.org/wiki/Comparison_of_Microsoft_Windows_versions