Incidentally, did you know EnCase’s Registry parser is broken and does not support DB blocks? python-registry, OTOH, is good to go ;-)