plaso.parsers.bencode_plugins package

Submodules

plaso.parsers.bencode_plugins.interface module

Bencode parser plugin interface.

BencodePlugin defines the attributes necessary for registration, discovery and operation of plugins for bencoded files which will be used by BencodeParser.

class plaso.parsers.bencode_plugins.interface.BencodePlugin[source]

Bases: plaso.parsers.plugins.BasePlugin

Bencode parser plugin interface.

CheckRequiredKeys(bencode_file)[source]

Check if the bencode file has the minimal keys required by the plugin.

Parameters

bencode_file (BencodeFile) – bencode file.

Returns

True if the bencode file has the minimum keys defined by the plugin,

or False if it does not or no required keys are defined. The bencode file can have more keys than specified by the plugin and still return True.

Return type

bool

DATA_FORMAT = 'Bencoded file'
NAME = 'bencode_plugin'
abstract Process(parser_mediator, bencode_file=None, **kwargs)[source]

Extracts events from the values of entries within a bencode file.

This is the main method that a Bencode plugin needs to implement.

The contents of the bencode keys defined in _BENCODE_KEYS can be made available to the plugin as both a matched{‘KEY’: ‘value’} and as the entire bencoded data dictionary. The plugin should implement logic to parse the most relevant data set into a useful event for incorporation into the Plaso timeline.

The attributes for a BencodeEvent should include the following:

root = Root key this event was extracted from. key = Key the value resided in. time = Date this artifact was created in micro seconds (usec) from

January 1, 1970 00:00:00 UTC.

desc = Short description.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • bencode_file (Optional[BencodeFile]) – bencode file.

URLS = []

plaso.parsers.bencode_plugins.transmission module

Bencode parser plugin for Transmission BitTorrent files.

class plaso.parsers.bencode_plugins.transmission.TransmissionBencodePlugin[source]

Bases: plaso.parsers.bencode_plugins.interface.BencodePlugin

Parse Transmission BitTorrent activity file for current torrents.

Transmission stores an individual Bencoded file for each active download in a folder named resume under the user’s application data folder.

DATA_FORMAT = 'Transmission BitTorrent activity file'
NAME = 'bencode_transmission'
Process(parser_mediator, bencode_file=None, **kwargs)[source]

Extracts events from Transmission’s resume folder files.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • bencode_file (Optional[BencodeFile]) – bencode file.

class plaso.parsers.bencode_plugins.transmission.TransmissionEventData[source]

Bases: plaso.containers.events.EventData

Transmission BitTorrent event data.

destination

path of the downloaded file.

Type

str

seedtime

client seed time in number of minutes.

Type

int

DATA_TYPE = 'p2p:bittorrent:transmission'

plaso.parsers.bencode_plugins.utorrent module

Bencode parser plugin for uTorrent active torrent files.

class plaso.parsers.bencode_plugins.utorrent.UTorrentBencodePlugin[source]

Bases: plaso.parsers.bencode_plugins.interface.BencodePlugin

Plugin to extract parse uTorrent active torrent files.

uTorrent creates a file, resume.dat, and a backup, resume.dat.old, to for all active torrents. This is typically stored in the user’s application data folder.

These files, at a minimum, contain a ‘.fileguard’ key and a dictionary with a key name for a particular download with a ‘.torrent’ file extension.

DATA_FORMAT = 'uTorrent active torrent file'
NAME = 'bencode_utorrent'
Process(parser_mediator, bencode_file=None, **kwargs)[source]

Extracts events from uTorrent active torrent files.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • bencode_file (Optional[BencodeFile]) – bencode file.

class plaso.parsers.bencode_plugins.utorrent.UTorrentEventData[source]

Bases: plaso.containers.events.EventData

uTorrent active torrent event data.

caption

official name of package.

Type

str

destination

path of the downloaded file.

Type

str

seedtime

client seed time in number of minutes.

Type

int

DATA_TYPE = 'p2p:bittorrent:utorrent'

Module contents

Imports for the bencode parser.