Source code for plaso.parsers.bencode_plugins.transmission

# -*- coding: utf-8 -*-
"""Bencode parser plugin for Transmission BitTorrent files."""

from __future__ import unicode_literals

from dfdatetime import posix_time as dfdatetime_posix_time

from plaso.containers import events
from plaso.containers import time_events
from plaso.lib import definitions
from plaso.parsers import bencode_parser
from plaso.parsers.bencode_plugins import interface


[docs]class TransmissionEventData(events.EventData): """Transmission BitTorrent event data. Attributes: destination (str): path of the downloaded file. seedtime (int): client seed time in number of minutes. """ DATA_TYPE = 'p2p:bittorrent:transmission' def __init__(self): """Initializes event data.""" super(TransmissionEventData, self).__init__(data_type=self.DATA_TYPE) self.destination = None self.seedtime = None
[docs]class TransmissionPlugin(interface.BencodePlugin): """Parse Transmission BitTorrent activity file for current torrents. Transmission stores an individual Bencoded file for each active download in a folder named resume under the user's application data folder. """ NAME = 'bencode_transmission' DESCRIPTION = 'Parser for Transmission bencoded files.' BENCODE_KEYS = frozenset([ 'activity-date', 'added-date', 'destination', 'done-date', 'seeding-time-seconds'])
[docs] def Process(self, parser_mediator, decoded_values=None, **kwargs): """Extracts events from Transmission's resume folder files. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfvfs. decoded_values (Optional[collections.OrderedDict[bytes|str, object]]): decoded values. """ # This will raise if unhandled keyword arguments are passed. super(TransmissionPlugin, self).Process(parser_mediator, **kwargs) destination = self._GetDecodedValue(decoded_values, 'destination') seeding_time = self._GetDecodedValue(decoded_values, 'seeding-time-seconds') event_data = TransmissionEventData() event_data.destination = destination # Convert seconds to minutes. event_data.seedtime, _ = divmod(seeding_time, 60) timestamp = self._GetDecodedValue(decoded_values, 'added-date') if timestamp: date_time = dfdatetime_posix_time.PosixTime(timestamp=timestamp) event = time_events.DateTimeValuesEvent( date_time, definitions.TIME_DESCRIPTION_ADDED) parser_mediator.ProduceEventWithEventData(event, event_data) timestamp = self._GetDecodedValue(decoded_values, 'done-date') if timestamp: date_time = dfdatetime_posix_time.PosixTime(timestamp=timestamp) event = time_events.DateTimeValuesEvent( date_time, definitions.TIME_DESCRIPTION_FILE_DOWNLOADED) parser_mediator.ProduceEventWithEventData(event, event_data) timestamp = self._GetDecodedValue(decoded_values, 'activity-date') if timestamp: date_time = dfdatetime_posix_time.PosixTime(timestamp=timestamp) event = time_events.DateTimeValuesEvent( date_time, definitions.TIME_DESCRIPTION_LAST_ACCESS) parser_mediator.ProduceEventWithEventData(event, event_data)
bencode_parser.BencodeParser.RegisterPlugin(TransmissionPlugin)