# -*- coding: utf-8 -*-
"""This file contains an Outlook search MRU Registry parser."""
from plaso.containers import events
from plaso.parsers import winreg_parser
from plaso.parsers.winreg_plugins import interface
[docs]
class OutlookSearchMRUEventData(events.EventData):
"""Outlook search MRU event data attribute container.
Attributes:
entries (str): most recently used (MRU) entries.
key_path (str): Windows Registry key path.
last_written_time (dfdatetime.DateTimeValues): entry last written date and
time.
"""
DATA_TYPE = 'windows:registry:outlook_search_mru'
[docs]
def __init__(self):
"""Initializes event data."""
super(OutlookSearchMRUEventData, self).__init__(data_type=self.DATA_TYPE)
self.entries = None
self.key_path = None
self.last_written_time = None
[docs]
class OutlookSearchMRUPlugin(interface.WindowsRegistryPlugin):
"""Windows Registry plugin parsing Outlook Search MRU keys."""
NAME = 'microsoft_outlook_mru'
DATA_FORMAT = 'Microsoft Outlook search MRU Registry data'
FILTERS = frozenset([
interface.WindowsRegistryKeyPathFilter(
'HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\'
'Search'),
interface.WindowsRegistryKeyPathFilter(
'HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\'
'Search')])
# TODO: The catalog for Office 2013 (15.0) contains binary values not
# dword values. Check if Office 2007 and 2010 have the same. Re-enable the
# plug-ins once confirmed and OutlookSearchMRUPlugin has been extended to
# handle the binary data or create a OutlookSearchCatalogMRUPlugin.
# Registry keys for:
# MS Outlook 2007 Search Catalog:
# 'HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\12.0\\Outlook\\'
# 'Catalog'
# MS Outlook 2010 Search Catalog:
# 'HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\'
# 'Search\\Catalog'
# MS Outlook 2013 Search Catalog:
# 'HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\'
# 'Search\\Catalog'
winreg_parser.WinRegistryParser.RegisterPlugin(OutlookSearchMRUPlugin)