plaso.parsers.bencode_plugins package

Submodules

plaso.parsers.bencode_plugins.interface module

Bencode parser plugin interface.

BencodePlugin defines the attributes necessary for registration, discovery and operation of plugins for bencoded files which will be used by BencodeParser.

class plaso.parsers.bencode_plugins.interface.BencodePlugin[source]

Bases: plaso.parsers.plugins.BasePlugin

Bencode parser plugin interface.

BENCODE_KEYS = frozenset({'any'})
DATA_FORMAT = 'Bencoded file'
NAME = 'bencode_plugin'
abstract Process(parser_mediator, decoded_values=None, **kwargs)[source]

Extracts events from the values of entries within a bencoded file.

This is the main method that a Bencode plugin needs to implement.

The contents of the bencode keys defined in BENCODE_KEYS can be made available to the plugin as both a matched{‘KEY’: ‘value’} and as the entire bencoded data dictionary. The plugin should implement logic to parse the most relevant data set into a useful event for incorporation into the Plaso timeline.

The attributes for a BencodeEvent should include the following:

root = Root key this event was extracted from. key = Key the value resided in. time = Date this artifact was created in micro seconds (usec) from

January 1, 1970 00:00:00 UTC.

desc = Short description.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • decoded_values (Optional[collections.OrderedDict[bytes|str, object]]) – decoded values.

URLS = []

plaso.parsers.bencode_plugins.transmission module

Bencode parser plugin for Transmission BitTorrent files.

class plaso.parsers.bencode_plugins.transmission.TransmissionEventData[source]

Bases: plaso.containers.events.EventData

Transmission BitTorrent event data.

destination

path of the downloaded file.

Type

str

seedtime

client seed time in number of minutes.

Type

int

DATA_TYPE = 'p2p:bittorrent:transmission'
class plaso.parsers.bencode_plugins.transmission.TransmissionPlugin[source]

Bases: plaso.parsers.bencode_plugins.interface.BencodePlugin

Parse Transmission BitTorrent activity file for current torrents.

Transmission stores an individual Bencoded file for each active download in a folder named resume under the user’s application data folder.

BENCODE_KEYS = frozenset({'activity-date', 'added-date', 'destination', 'done-date', 'seeding-time-seconds'})
DATA_FORMAT = 'Transmission BitTorrent activity file'
NAME = 'bencode_transmission'
Process(parser_mediator, decoded_values=None, **kwargs)[source]

Extracts events from Transmission’s resume folder files.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • decoded_values (Optional[collections.OrderedDict[bytes|str, object]]) – decoded values.

plaso.parsers.bencode_plugins.utorrent module

Bencode parser plugin for uTorrent active torrent files.

class plaso.parsers.bencode_plugins.utorrent.UTorrentEventData[source]

Bases: plaso.containers.events.EventData

uTorrent active torrent event data.

caption

official name of package.

Type

str

destination

path of the downloaded file.

Type

str

seedtime

client seed time in number of minutes.

Type

int

DATA_TYPE = 'p2p:bittorrent:utorrent'
class plaso.parsers.bencode_plugins.utorrent.UTorrentPlugin[source]

Bases: plaso.parsers.bencode_plugins.interface.BencodePlugin

Plugin to extract parse uTorrent active torrent files.

uTorrent creates a file, resume.dat, and a backup, resume.dat.old, to for all active torrents. This is typically stored in the user’s application data folder.

These files, at a minimum, contain a ‘.fileguard’ key and a dictionary with a key name for a particular download with a ‘.torrent’ file extension.

BENCODE_KEYS = frozenset({'.fileguard'})
DATA_FORMAT = 'uTorrent active torrent file'
NAME = 'bencode_utorrent'
Process(parser_mediator, decoded_values=None, **kwargs)[source]

Extracts events from uTorrent active torrent files.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • decoded_values (Optional[collections.OrderedDict[bytes|str, object]]) – decoded values.

Module contents

Imports for the bencode parser.