Source code for plaso.formatters.winprefetch

"""Windows Prefetch custom event formatter helpers."""

from plaso.formatters import interface
from plaso.formatters import manager




class WindowsPrefetchPathHintsFormatterHelper(interface.CustomEventFormatterHelper):
    """Windows Prefetch path hints formatter helper."""

    IDENTIFIER = "windows_prefetch_path_hints"



    def FormatEventValues(self, output_mediator, event_values):
        """Formats event values using the helper.

        Args:
          output_mediator (OutputMediator): output mediator.
          event_values (dict[str, object]): event values.
        """
        path_hints = event_values.get("path_hints")
        if path_hints:
            event_values["path_hints"] = "; ".join(path_hints)






class WindowsPrefetchVolumesStringFormatterHelper(interface.CustomEventFormatterHelper):
    """Windows Prefetch volumes string formatter helper."""

    IDENTIFIER = "windows_prefetch_volumes_string"



    def FormatEventValues(self, output_mediator, event_values):
        """Formats event values using the helper.

        Args:
          output_mediator (OutputMediator): output mediator.
          event_values (dict[str, object]): event values.
        """
        number_of_volumes = event_values.get("number_of_volumes", 0)
        volume_serial_numbers = event_values.get("volume_serial_numbers")
        volume_device_paths = event_values.get("volume_device_paths")

        volumes_strings = []
        for volume_index in range(0, number_of_volumes):
            if not volume_serial_numbers:
                volume_serial_number = "UNKNOWN"
            else:
                volume_serial_number = f"0x{volume_serial_numbers[volume_index]:08X}"

            if not volume_device_paths:
                volume_device_path = "UNKNOWN"
            else:
                volume_device_path = volume_device_paths[volume_index]

            volumes_strings.append(
                f"volume: {volume_index + 1:d} [serial number: "
                f"{volume_serial_number:s}, device path: {volume_device_path:s}]"
            )

        if volumes_strings:
            event_values["volumes_string"] = ", ".join(volumes_strings)




manager.FormattersManager.RegisterEventFormatterHelpers(
    [
        WindowsPrefetchPathHintsFormatterHelper,
        WindowsPrefetchVolumesStringFormatterHelper,
    ]
)