plaso.parsers.czip_plugins package

Submodules

plaso.parsers.czip_plugins.interface module

Interface for compound zip file plugins.

class plaso.parsers.czip_plugins.interface.CompoundZIPPlugin[source]

Bases: plaso.parsers.plugins.BasePlugin

Compound zip parser plugin.

abstract InspectZipFile(parser_mediator, zip_file)[source]

Inspects a compound ZIP file and produces events.

This is the main method that a compound ZIP plugin needs to implement.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • zip_file (zipfile.ZipFile) – the zip file. It should not be closed in this method, but will be closed by the parser logic in czip.py.

NAME = 'czip_plugin'
Process(parser_mediator, zip_file, archive_members)[source]

Determines if this is the correct plugin; if so proceed with processing.

This method checks if the zip file being contains the paths specified in REQUIRED_PATHS. If all paths are present, the plugin logic processing continues in InspectZipFile.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • zip_file (zipfile.ZipFile) – the zip file. It should not be closed in this method, but will be closed by the parser logic in czip.py.

  • archive_members (list[str]) – file paths in the archive.

Raises
  • UnableToParseFile – when the file cannot be parsed.

  • ValueError – if a subclass has not specified REQUIRED_PATHS.

  • WrongCompoundZIPPlugin – If this plugin is not able to process the given file.

REQUIRED_PATHS = frozenset({})

plaso.parsers.czip_plugins.oxml module

Compound ZIP parser plugin for OpenXML files.

class plaso.parsers.czip_plugins.oxml.OpenXMLEventData[source]

Bases: plaso.containers.events.EventData

OXML event data.

app_version

version of application that created document.

Type

str

author

name of author.

Type

str

creating_app

name of application that created document.

Type

str

doc_security

???

Type

str

True if hyperlinks have changed.

Type

bool

i4

???

Type

str

last_saved_by

name of user that last saved the document.

Type

str

True if the links are up to date.

Type

bool

number_of_characters

number of characters without spaces in the document.

Type

int

number_of_characters_with_spaces

number of characters including spaces in the document.

Type

int

number_of_lines

number of lines in the document.

Type

int

number_of_pages

number of pages in the document.

Type

int

number_of_paragraphs

number of paragraphs in the document.

Type

int

number_of_words

number of words in the document.

Type

int

revision_number

revision number.

Type

int

scale_crop

True if crop to scale is enabled.

Type

bool

shared_doc

True if document is shared.

Type

bool

template

name of template ???

Type

str

total_time

???

Type

str

DATA_TYPE = 'metadata:openxml'
class plaso.parsers.czip_plugins.oxml.OpenXMLPlugin[source]

Bases: plaso.parsers.czip_plugins.interface.CompoundZIPPlugin

Parse metadata from OXML files.

DESCRIPTION = 'Parser for OpenXML (OXML) files.'
InspectZipFile(parser_mediator, zip_file)[source]

Parses an OXML file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • zip_file (zipfile.ZipFile) –

    the zip file containing OXML content. It is not be closed in this method, but will be closed by the parser logic

    in czip.py.

Raises

UnableToParseFile – when the file cannot be parsed.

NAME = 'oxml'
REQUIRED_PATHS = frozenset({'[Content_Types].xml', '_rels/.rels', 'docProps/core.xml'})

Module contents

Imports for the compound ZIP parser.