+ errno = 0;
+ node = hivex_node_get_child (h, root, "MountedDevices");
+ if (node == 0) {
+ if (errno != 0)
+ perrorf (g, "hivex_node_get_child");
+ else
+ error (g, "hivex: could not locate HKLM\\SYSTEM\\MountedDevices");
+ goto out;
+ }
+
+ values = hivex_node_values (h, node);
+
+ /* Count how many DOS drive letter mappings there are. This doesn't
+ * ignore removable devices, so it overestimates, but that doesn't
+ * matter because it just means we'll allocate a few bytes extra.
+ */
+ for (i = count = 0; values[i] != 0; ++i) {
+ char *key = hivex_value_key (h, values[i]);
+ if (key == NULL) {
+ perrorf (g, "hivex_value_key");
+ goto out;
+ }
+ if (STRCASEEQLEN (key, "\\DosDevices\\", 12) &&
+ c_isalpha (key[12]) && key[13] == ':')
+ count++;
+ }
+
+ fs->drive_mappings = calloc (2*count + 1, sizeof (char *));
+ if (fs->drive_mappings == NULL) {
+ perrorf (g, "calloc");
+ goto out;
+ }
+
+ for (i = count = 0; values[i] != 0; ++i) {
+ char *key = hivex_value_key (h, values[i]);
+ if (key == NULL) {
+ perrorf (g, "hivex_value_key");
+ goto out;
+ }
+ if (STRCASEEQLEN (key, "\\DosDevices\\", 12) &&
+ c_isalpha (key[12]) && key[13] == ':') {
+ /* Get the binary value. Is it a fixed disk? */
+ char *blob, *device;
+ size_t len;
+ hive_type type;
+
+ blob = hivex_value_value (h, values[i], &type, &len);
+ if (blob != NULL && type == 3 && len == 12) {
+ /* Try to map the blob to a known disk and partition. */
+ device = map_registry_disk_blob (g, blob);
+ if (device != NULL) {
+ fs->drive_mappings[count++] = safe_strndup (g, &key[12], 1);
+ fs->drive_mappings[count++] = device;
+ }
+ }
+ free (blob);
+ }
+ }
+
+ /* Get the hostname. */