Skip to content

Clarify documentation on REGISTRY_KEY source#662

Merged
joachimmetz merged 1 commit intoForensicArtifacts:mainfrom
panhania:docs/regkey-spec
Apr 23, 2026
Merged

Clarify documentation on REGISTRY_KEY source#662
joachimmetz merged 1 commit intoForensicArtifacts:mainfrom
panhania:docs/regkey-spec

Conversation

@panhania
Copy link
Copy Markdown
Contributor

Registry key contents is quite ambiguous (and means something different from registry value contents), so the wording is clarified after consulting with @joachimmetz.

Furthermore, this also fixes the example that is not consistent with the description of the keys attribute:

A list of Windows Registry key paths (...)

I verified on my machine and HKEY_USERS\*\Software\Microsoft\Internet Explorer\TypedURLs users contains no subkeys, only values (e.g. url1 with content http://go.microsoft.com/fwlink/p/?LinkId=255141). Thus, the glob here will match no key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths proposed here on the other hand contains multiple subkeys (e.g. chrome.exe, pwsh.exe, mplayer2.exe) which contain values specifying the path (but are not consistent: some do it through the default value, some do it through value named Path).

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 22, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.33%. Comparing base (be86a49) to head (2fdb892).
⚠️ Report is 33 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #662      +/-   ##
==========================================
- Coverage   69.70%   69.33%   -0.37%     
==========================================
  Files           9        9              
  Lines         769      763       -6     
==========================================
- Hits          536      529       -7     
- Misses        233      234       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Copy Markdown
Member

@joachimmetz joachimmetz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for the proposed changes

@joachimmetz joachimmetz merged commit e4a178d into ForensicArtifacts:main Apr 23, 2026
11 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants