# -*- coding: utf-8 -*-
"""This file contains a WinRAR history Windows Registry plugin."""
import re
from plaso.containers import events
from plaso.parsers import winreg_parser
from plaso.parsers.winreg_plugins import interface
[docs]
class WinRARHistoryEventData(events.EventData):
"""WinRAR history event data attribute container.
Attributes:
entries (str): archive history entries.
key_path (str): Windows Registry key path.
last_written_time (dfdatetime.DateTimeValues): entry last written date and
time.
"""
DATA_TYPE = 'winrar:history'
[docs]
def __init__(self):
"""Initializes event data."""
super(WinRARHistoryEventData, self).__init__(data_type=self.DATA_TYPE)
self.entries = None
self.key_path = None
self.last_written_time = None
[docs]
class WinRARHistoryPlugin(interface.WindowsRegistryPlugin):
"""Windows Registry plugin for parsing WinRAR History keys."""
NAME = 'winrar_mru'
DATA_FORMAT = 'WinRAR History Registry data'
FILTERS = frozenset([
interface.WindowsRegistryKeyPathFilter(
'HKEY_CURRENT_USER\\Software\\WinRAR\\ArcHistory'),
interface.WindowsRegistryKeyPathFilter(
'HKEY_CURRENT_USER\\Software\\WinRAR\\DialogEditHistory\\ArcName'),
interface.WindowsRegistryKeyPathFilter(
'HKEY_CURRENT_USER\\Software\\WinRAR\\DialogEditHistory\\ExtrPath')])
_RE_VALUE_NAME = re.compile(r'^[0-9]+$', re.I)
winreg_parser.WinRegistryParser.RegisterPlugin(WinRARHistoryPlugin)