Source code for plaso.parsers.plist_plugins.ipod

# -*- coding: utf-8 -*-
"""Plist parser plugin for iPod, iPad and iPhone storage plist files."""

from plaso.containers import events
from plaso.parsers import plist
from plaso.parsers.plist_plugins import interface

[docs] class IPodPlistEventData(events.EventData): """iPod plist event data. Attributes: device_class (str): device class. device_identifier (str): identifier of the device. family_identifier (str): identifier of the device family. firmware_version (str): firmware version. imei (str): IMEI (International Mobile Equipment Identity). last_connected_time (dfdatetime.DateTimeValues): last date and time the iPod, iPad or iPhone storage (device) was connected. serial_number (str): serial number. use_count (str): number of times the device was used. """ DATA_TYPE = 'ipod:device:entry'
[docs] def __init__(self): """Initializes event data.""" super(IPodPlistEventData, self).__init__(data_type=self.DATA_TYPE) self.device_class = None self.device_identifier = None self.family_identifier = None self.firmware_version = None self.imei = None self.last_connected_time = None self.serial_number = None self.use_count = None
[docs] class IPodPlugin(interface.PlistPlugin): """Plist parser plugin for iPod, iPad and iPhone storage plist files.""" NAME = 'ipod_device' DATA_FORMAT = 'iPod, iPad and iPhone plist file' PLIST_PATH_FILTERS = frozenset([ interface.PlistPathFilter('')]) PLIST_KEYS = frozenset(['Devices']) # pylint: disable=arguments-differ def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs): """Extract device information from the iPod plist. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS. """ devices = match.get('Devices', {}) for device_identifier, plist_key in devices.items(): event_data = IPodPlistEventData() event_data.device_identifier = device_identifier event_data.device_class = plist_key.get('Device Class', None) event_data.family_identifier = plist_key.get('Family ID', None) event_data.firmware_version = plist_key.get( 'Firmware Version String', None) event_data.imei = plist_key.get('IMEI', None) event_data.last_connected_time = self._GetDateTimeValueFromPlistKey( plist_key, 'Connected') event_data.serial_number = plist_key.get('Serial Number', None) event_data.use_count = plist_key.get('Use Count', None) parser_mediator.ProduceEventData(event_data)