Earlier today I posted an EnScript that parses the 'nk' registry records from any selected files in EnCase. You can read about that EnScript in the original post here.
This EnScript essentially does the same basic function, except it searches for 'vk' records, which are the records that hold data values. The registry hive holds different types of data in different records. A 'vk' record can have the data value "resident" inside the 'vk' record itself, or it can be "non-resident" and have its own record elsewhere in the registry hive.
Therefore, when searching for 'vk' records, it is common to find the record, but it either has no data value name and/or data value inside that specific record. Using the same example I used in the previous post about 'nk' records, here is an example:
In the screenshot above, I searched the pagefile. The value names can bee see in the comment field on the right. After the value name, the data value itself is displayed if it was resident to that 'vk' record. You can see several bookmarks that have a value name, but no value itself. This is because the value was not resident to that record and is stored elsewhere. Some value names are blank and therefore you will see the name "default" (as you would typically see in regedit or other registry viewer).
This EnScript only bookmarks the data.