..
    generated, remove this comment to keep this file

``catroot.catdb``
=================

.. code-block:: console

    $ target-query <path/to/target> -f catroot.catdb


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``dissect.target.plugins.os.windows.catroot.CatrootPlugin``
    * - Output
      - ``records``

**Module documentation**

Catroot plugin.

Parses catroot files for hashes and file hints.

**Function documentation**

Return the hash values present in the catdb files in the catroot2 folder.

The catdb file is an ESE database file that contains the digests of the catalog files present on the system.
This database is used to speed up the process of validating a Portable Executable (PE) file.

Note: catalog files can include file hints, however these seem not to be present in the catdb files.

References:
    - https://www.thewindowsclub.com/catroot-catroot2-folder-reset-windows
    - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/catalog-files

Yields CatrootRecords with the following fields:

.. code-block:: text

    hostname (string): The target hostname.
    domain (string): The target domain.
    digest (digest): The parsed digest.
    hints (string[]): File hints, if present.
    catroot_name (string): Catroot name.
    source (path): Source of the catroot record.