diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 94dce8c4d0..014516b7c5 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -105,9 +105,7 @@ def enumerate_mft_records( # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType while attr.Attr_Header.AttrType.is_valid_choice: - yield from attr_callback( - record_map, mft_record, attr, symbol_table - ) + yield from attr_callback(record_map, mft_record, attr, symbol_table) # If there's no advancement the loop will never end, so break it now if attr.Attr_Header.Length == 0: @@ -271,7 +269,10 @@ def parse_data_records( def _generator(self): for record in self.enumerate_mft_records( - self.context, self.config_path, self.config["primary"], self.parse_mft_records + self.context, + self.config_path, + self.config["primary"], + self.parse_mft_records, ): yield record @@ -352,7 +353,10 @@ def _generator(self): ads_name, content, ) in MFTScan.enumerate_mft_records( - self.context, self.config_path, self.config["primary"], self.parse_ads_data_records + self.context, + self.config_path, + self.config["primary"], + self.parse_ads_data_records, ): yield ( 0, @@ -418,7 +422,10 @@ def _generator(self): _, content, ) in MFTScan.enumerate_mft_records( - self.context, self.config_path, self.config["primary"], self.parse_first_data_records + self.context, + self.config_path, + self.config["primary"], + self.parse_first_data_records, ): yield (0, (offset, rec_type, rec_num, attr_type, file_name, content))