EnScript to find and parse "vk" registry keys

Earlier today I posted an EnScript that parses the 'nk' registry records from any selected files in EnCase. You can read about that EnScript in the original post here.

This EnScript essentially does the same basic function, except it searches for 'vk' records, which are the records that hold data values. The registry hive holds different types of data in different records. A 'vk' record can have the data value "resident" inside the 'vk' record itself, or it can be "non-resident" and have its own record elsewhere in the registry hive.

Therefore, when searching for 'vk' records, it is common to find the record, but it either has no data value name and/or data value inside that specific record.  Using the same example I used in the previous post about 'nk' records, here is an example:

The "MountedDevices" folder (key) is a 'nk' record that we covered in the previous post. The data values are on the right side of the window. The data value names are things like "\DosDevices\C:", "\DosDevices\D:", etc. The data value itself is the value thats stored inside that specific data name entry. For instance the data name  "\DosDevices\C:" would commonly have a value similar to what you see here:

The value data inside the data value name is the hex values you see above.

This EnScript attempts to find 'vk' records and then parses them as best as possible. As mentioned, it is common for the actual data value to be stored elsewhere and therefore cannot be parsed. If the data value is smaller than 4 bytes, then it is stored within the 'vk' record along with the value name. Here is an example of the output of the EnScript:

In the screenshot above, I searched the pagefile. The value names can bee see in the comment field on the right. After the value name, the data value itself is displayed if it was resident to that 'vk' record.  You can see several bookmarks that have a value name, but no value itself. This is because the value was not resident to that record and is stored elsewhere.  Some value names are blank and therefore you will see the name "default" (as you would typically see in regedit or other registry viewer).

This EnScript only bookmarks the data.

Download Here