regffs

Read Windows registry files (regf) as io/fs.FS.

Example

func main() {
	f, _ := os.Open("testdata/SYSTEM")

	// init file system
	fsys, _ := regffs.New(f)

	// print all paths
	b, _ := fs.ReadFile(fsys, "ControlSet001/Control/ComputerName/ComputerName/ComputerName")
	s, _ := regffs.DecodeRegSz(b)
	fmt.Println(s)
	// Output: WKS-WIN732BITA
}

License

testdata is from https://github.com/log2timeline/plaso and therefore licenced under Apache License 2.0. The remaining files are MIT licensed.