From ff4f6af681e69513db03960e0c24cee419e4fddb Mon Sep 17 00:00:00 2001 From: Joachim Metz Date: Sat, 14 Dec 2024 11:37:21 +0100 Subject: [PATCH] Update amcache.py --- plaso/parsers/winreg_plugins/amcache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plaso/parsers/winreg_plugins/amcache.py b/plaso/parsers/winreg_plugins/amcache.py index 2bde1d9f63..0352435d39 100644 --- a/plaso/parsers/winreg_plugins/amcache.py +++ b/plaso/parsers/winreg_plugins/amcache.py @@ -22,8 +22,8 @@ class AMCacheFileEventData(events.EventData): file_creation_time (dfdatetime.DateTimeValues): file entry creation date and time. file_description (str): description of file. - file_identifier (str): identifier of file (SHA-1 of the first 31,457,280 - bytes of file, preceded by '0000'). + file_identifier (str): identifier of file (SHA-1 of the first 30 MiB + (31457280 bytes) of file, preceded by "0000"). file_modification_time (dfdatetime.DateTimeValues): file entry last modification date and time. file_reference (str): file system file reference, for example 9-1 (MFT