Worked on script to check artifact definitions (#6)

ForensicArtifacts · Feb 20, 2022 · 9a0faf2 · 9a0faf2
1 parent e27d7fe
commit 9a0faf2
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/artifactsrc/volume_scanner.py b/artifactsrc/volume_scanner.py
@@ -240,7 +240,7 @@ def _ReadStructureFromFileObject(
     """
     structure_values = None
 
-    data_size = data_type_map.GetByteSize()
+    data_size = data_type_map.GetSizeHint()
     if data_size:
       file_object.seek(file_offset, os.SEEK_SET)
       try:

diff --git a/data/checks.yaml b/data/checks.yaml
@@ -24,6 +24,9 @@ formats: ['regf']
 name: WindowsScheduledTasks
 formats: ['job']
 ---
+name: WindowsSearchDatabase
+formats: ['esedb']
+---
 name: WindowsSystemRegistryFiles
 formats: ['regf']
 ---