Windows: remove size from filescan output as it is not the file size …

…but the object size
eve-mem · Jul 12, 2024 · c3cf319 · c3cf319
1 parent 1d4a27e
commit c3cf319
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py
@@ -13,7 +13,7 @@
 class FileScan(interfaces.plugins.PluginInterface):
     """Scans for file objects present in a particular windows memory image."""
 
-    _required_framework_version = (2, 0, 0)
+    _required_framework_version = (2, 0, 1)
 
     @classmethod
     def get_requirements(cls):
@@ -67,10 +67,10 @@ def _generator(self):
             except exceptions.InvalidAddressException:
                 continue
 
-            yield (0, (format_hints.Hex(fileobj.vol.offset), file_name, fileobj.Size))
+            yield (0, (format_hints.Hex(fileobj.vol.offset), file_name))
 
     def run(self):
         return renderers.TreeGrid(
-            [("Offset", format_hints.Hex), ("Name", str), ("Size", int)],
+            [("Offset", format_hints.Hex), ("Name", str)],
             self._generator(),
         )