Hello,
As we discussed briefly on IRC about a month ago, HKLM\SYSTEM\MountedDevices can contain
greater than 55000 (HIVEX_MAX_VALUES) values if VMWare’s snapshot functionality is
frequently used. This is due to an unintended interaction between Windows and VMWare’s
snapshot functionality.
VMware has a knowledge base article regarding this issue, although it does not directly
mention MountedDevices:
https://kb.vmware.com/s/article/2006849
The attached patch increases HIVEX_MAX_VALUES in order to enable access to those hives
with hivex.
--
Matt Coleman
Senior Software Engineer
Datto, Inc.
www.datto.com