Source code for plaso.parsers.plist_plugins.ios_carplay

# -*- coding: utf-8 -*-
"""Plist parser plugin for Apple iOS Car Play application plist files.

The plist contains history of opened applications in the Car Play application.

from dfdatetime import posix_time as dfdatetime_posix_time

from plaso.containers import events
from plaso.lib import definitions
from plaso.parsers import plist
from plaso.parsers.plist_plugins import interface

[docs] class IOSCarPlayHistoryEventData(events.EventData): """Apple iOS Car Play application history event data. Attributes: application_identifier (str): application identifier. last_run_time (dfdatetime.DateTimeValues): application last run date and time. """ DATA_TYPE = 'ios:carplay:history:entry'
[docs] def __init__(self): """Initializes event data.""" super(IOSCarPlayHistoryEventData, self).__init__(data_type=self.DATA_TYPE) self.application_identifier = None self.last_run_time = None
[docs] class IOSCarPlayPlistPlugin(interface.PlistPlugin): """Plist parser plugin for Apple iOS Car Play application plist files.""" NAME = 'ios_carplay' DATA_FORMAT = 'Apple iOS Car Play application plist file' PLIST_PATH_FILTERS = frozenset([ interface.PlistPathFilter('')]) PLIST_KEYS = frozenset(['CARRecentAppHistory']) # pylint: disable=arguments-differ def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs): """Extract Car Play application history entries. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS. """ plist_key = match.get('CARRecentAppHistory', {}) for application_identifier, datetime_value in plist_key.items(): event_data = IOSCarPlayHistoryEventData() event_data.application_identifier = application_identifier if datetime_value: timestamp = int(datetime_value * definitions.NANOSECONDS_PER_SECOND) event_data.last_run_time = dfdatetime_posix_time.PosixTimeInNanoseconds( timestamp=timestamp) parser_mediator.ProduceEventData(event_data)