Source code for plaso.containers.event_sources

# -*- coding: utf-8 -*-
"""Event source attribute containers."""

from __future__ import unicode_literals

from plaso.containers import interface
from plaso.containers import manager

[docs]class EventSource(interface.AttributeContainer): """Event source attribute container. The event source object contains information about where a specific event originates e.g. a file, the $STANDARD_INFORMATION MFT attribute, or Application Compatibility cache. Attributes: data_type (str): attribute container type indicator. file_entry_type (str): dfVFS file entry type. path_spec (dfvfs.PathSpec): path specification. """ CONTAINER_TYPE = 'event_source' DATA_TYPE = None def __init__(self, path_spec=None): """Initializes an event source. Args: path_spec (Optional[dfvfs.PathSpec]): path specification. """ super(EventSource, self).__init__() self.data_type = self.DATA_TYPE self.file_entry_type = None self.path_spec = path_spec # This method is necessary for heap sort.
[docs] def __lt__(self, other): """Compares if the event source attribute container is less than the other. Args: other (EventSource): event source attribute container to compare to. Returns: bool: True if the event source attribute container is less than the other. """ return self.path_spec.comparable < other.path_spec.comparable
[docs]class FileEntryEventSource(EventSource): """File entry event source. The file entry event source is an event source that represents a file within a file system. """ DATA_TYPE = 'file_entry'