plaso.parsers.czip_plugins package

Submodules

plaso.parsers.czip_plugins.interface module

Interface for compound zip file plugins.

class plaso.parsers.czip_plugins.interface.CompoundZIPPlugin[source]

Bases: plaso.parsers.plugins.BasePlugin

Compound zip parser plugin.

InspectZipFile(parser_mediator, zip_file)[source]

Inspects a compound ZIP file and produces events.

This is the main method that a compound ZIP plugin needs to implement.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
  • zip_file (zipfile.ZipFile) – the zip file. It should not be closed in this method, but will be closed by the parser logic in czip.py.
NAME = u'czip'
Process(parser_mediator, zip_file, archive_members)[source]

Determines if this is the correct plugin; if so proceed with processing.

This method checks if the zip file being contains the paths specified in REQUIRED_PATHS. If all paths are present, the plugin logic processing continues in InspectZipFile.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
  • zip_file (zipfile.ZipFile) – the zip file. It should not be closed in this method, but will be closed by the parser logic in czip.py.
  • archive_members (list[str]) – file paths in the archive.
Raises:
  • UnableToParseFile – when the file cannot be parsed.
  • ValueError – if a subclass has not specified REQUIRED_PATHS.
REQUIRED_PATHS = frozenset([])

plaso.parsers.czip_plugins.oxml module

Compound ZIP parser plugin for OpenXML files.

class plaso.parsers.czip_plugins.oxml.OpenXMLEventData[source]

Bases: plaso.containers.events.EventData

OXML event data.

app_version

str – version of application that created document.

author

str – name of author.

creating_app

str – name of application that created document.

doc_security

str – ???

bool – True if hyperlinks have changed.

i4

str – ???

last_saved_by

str – name of user that last saved the document.

bool – True if the links are up to date.

number_of_characters

int – number of characters without spaces in the document.

number_of_characters_with_spaces

int – number of characters including spaces in the document.

number_of_lines

int – number of lines in the document.

number_of_pages

int – number of pages in the document.

number_of_paragraphs

int – number of paragraphs in the document.

number_of_words

int – number of words in the document.

revision_number

int – revision number.

scale_crop

bool – True if crop to scale is enabled.

shared_doc

bool – True if document is shared.

template

str – name of template ???

total_time

str – ???

DATA_TYPE = u'metadata:openxml'
class plaso.parsers.czip_plugins.oxml.OpenXMLPlugin[source]

Bases: plaso.parsers.czip_plugins.interface.CompoundZIPPlugin

Parse metadata from OXML files.

DESCRIPTION = u'Parser for OpenXML (OXML) files.'
InspectZipFile(parser_mediator, zip_file)[source]

Parses an OXML file-like object.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
  • zip_file (zipfile.ZipFile) –

    the zip file containing OXML content. It is not be closed in this method, but will be closed by the parser logic

    in czip.py.
Raises:

UnableToParseFile – when the file cannot be parsed.

NAME = u'oxml'
REQUIRED_PATHS = frozenset([u'[Content_Types].xml', u'docProps/core.xml', u'_rels/.rels'])

Module contents

Imports for the compound ZIP parser.