plaso.parsers.bencode_plugins package
Submodules
plaso.parsers.bencode_plugins.interface module
Bencode parser plugin interface.
- class plaso.parsers.bencode_plugins.interface.BencodePlugin[source]
Bases:
BasePluginBencode parser plugin interface.
- CheckRequiredKeys(bencode_file)[source]
Checks if the bencode file has the minimal keys required by the plugin.
- Parameters
bencode_file (BencodeFile) – bencode file.
- Returns
- True if the bencode file has the minimum keys defined by the plugin,
or False if it does not or no required keys are defined. The bencode file can have more keys than specified by the plugin and still return True.
- Return type
bool
- DATA_FORMAT = 'Bencoded file'
- NAME = 'bencode_plugin'
- abstract Process(parser_mediator, bencode_file=None, **kwargs)[source]
Extracts events from a bencode file.
This is the main method that a Bencode plugin needs to implement.
The contents of the bencode keys defined in _BENCODE_KEYS can be made available to the plugin as both a matched{‘KEY’: ‘value’} and as the entire bencoded data dictionary.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
bencode_file (Optional[BencodeFile]) – bencode file.
plaso.parsers.bencode_plugins.transmission module
Bencode parser plugin for Transmission BitTorrent files.
- class plaso.parsers.bencode_plugins.transmission.TransmissionBencodePlugin[source]
Bases:
BencodePluginParse Transmission BitTorrent activity file for current torrents.
Transmission stores an individual Bencoded file for each active download in a folder named resume under the user’s application data folder.
- DATA_FORMAT = 'Transmission BitTorrent activity file'
- NAME = 'bencode_transmission'
- Process(parser_mediator, bencode_file=None, **kwargs)[source]
Extracts events from a Transmission’s resume folder file.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
bencode_file (Optional[BencodeFile]) – bencode file.
- class plaso.parsers.bencode_plugins.transmission.TransmissionEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventDataTransmission BitTorrent event data.
- added_time
date and time the torrent was added to Transmission.
- Type
dfdatetime.DateTimeValues
- destination
path of the downloaded file.
- Type
str
- downloaded_time
date and time the content was downloaded.
- Type
dfdatetime.DateTimeValues
- last_activity_time
date and time of the last download activity.
- Type
dfdatetime.DateTimeValues
- seedtime
client seed time in number of minutes.
- Type
int
- DATA_TYPE = 'p2p:bittorrent:transmission'
plaso.parsers.bencode_plugins.utorrent module
Bencode parser plugin for uTorrent active torrent files.
- class plaso.parsers.bencode_plugins.utorrent.UTorrentBencodePlugin[source]
Bases:
BencodePluginPlugin to extract parse uTorrent active torrent files.
uTorrent creates a file, resume.dat, and a backup, resume.dat.old, to for all active torrents. This is typically stored in the user’s application data folder.
These files, at a minimum, contain a ‘.fileguard’ key and a dictionary with a key name for a particular download with a ‘.torrent’ file extension.
- DATA_FORMAT = 'uTorrent active torrent file'
- NAME = 'bencode_utorrent'
- Process(parser_mediator, bencode_file=None, **kwargs)[source]
Extracts events from an uTorrent active torrent file.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
bencode_file (Optional[BencodeFile]) – bencode file.
- class plaso.parsers.bencode_plugins.utorrent.UTorrentEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventDatauTorrent active torrent event data.
- added_time
date and time the torrent was added to Transmission.
- Type
dfdatetime.DateTimeValues
- caption
official name of package.
- Type
str
- destination
path of the downloaded file.
- Type
str
- downloaded_time
date and time the content was downloaded.
- Type
dfdatetime.DateTimeValues
- modification_times
modification dates and times.
- Type
list[dfdatetime.DateTimeValues]
- seedtime
client seed time in number of minutes.
- Type
int
- DATA_TYPE = 'p2p:bittorrent:utorrent'
Module contents
Imports for the bencode parser.