global definitions
definitions = {
    "mft":      '00',
    "winreg":   '01',
    "evt":      '02',
    "edb":      '03',
    "info":     '04'
}