helper function similar to _processValueItem to build a search string for a
    known key/value/type/data

def _buildKnownDataSearchString(reg_key, reg_valueName, reg_vtype, reg_data,
                                check_deleted=False):
    '''
    helper function similar to _processValueItem to build a search string for a
    known key/value/type/data
    '''
    registry = Registry()
    this_element_value = None
    expected_string = b''
    encoded_semicolon = ';'.encode('utf-16-le')
    encoded_null = chr(0).encode('utf-16-le')
    if reg_key:
        reg_key = reg_key.encode('utf-16-le')
    if reg_valueName:
        reg_valueName = reg_valueName.encode('utf-16-le')
    if reg_data and not check_deleted:
        if reg_vtype == 'REG_DWORD':
            this_element_value = struct.pack(b'I', int(reg_data))
        elif reg_vtype == "REG_QWORD":
            this_element_value = struct.pack(b'Q', int(reg_data))
        elif reg_vtype == 'REG_SZ':
            this_element_value = b''.join([reg_data.encode('utf-16-le'),
                                           encoded_null])
    if check_deleted:
        reg_vtype = 'REG_SZ'
        expected_string = b''.join(['['.encode('utf-16-le'),
                                    reg_key,
                                    encoded_null,
                                    encoded_semicolon,
                                    '**del.'.encode('utf-16-le'),
                                    reg_valueName,
                                    encoded_null,
                                    encoded_semicolon,
                                    chr(registry.vtype[reg_vtype]).encode('utf-32-le'),
                                    encoded_semicolon,
                                    six.unichr(len(' {0}'.format(chr(0)).encode('utf-16-le'))).encode('utf-32-le'),
                                    encoded_semicolon,
                                    ' '.encode('utf-16-le'),
                                    encoded_null,
                                    ']'.encode('utf-16-le')])
    else:
        expected_string = b''.join(['['.encode('utf-16-le'),
                                    reg_key,
                                    encoded_null,
                                    encoded_semicolon,
                                    reg_valueName,
                                    encoded_null,
                                    encoded_semicolon,
                                    chr(registry.vtype[reg_vtype]).encode('utf-32-le'),
                                    encoded_semicolon,
                                    six.unichr(len(this_element_value)).encode('utf-32-le'),
                                    encoded_semicolon,
                                    this_element_value,
                                    ']'.encode('utf-16-le')])
    return expected_string