plaso.parsers.czip_plugins package

Submodules

plaso.parsers.czip_plugins.interface module

Interface for compound ZIP file plugins.

class plaso.parsers.czip_plugins.interface.CompoundZIPPlugin[source]

Bases: plaso.parsers.plugins.BasePlugin

Compound ZIP parser plugin.

CheckRequiredPaths(zip_file)[source]

Check if the ZIP file has the minimal structure required by the plugin.

Parameters

zip_file (zipfile.ZipFile) – the ZIP file. It should not be closed in this method, but will be closed by the parser logic in czip.py.

Returns

True if the ZIP file has the minimum paths defined by the plugin,

or False if it does not or no required paths are defined. The ZIP file can have more paths than specified by the plugin and still return True.

Return type

bool

DATA_FORMAT = 'Compound ZIP file'
abstract InspectZipFile(parser_mediator, zip_file)[source]

Inspects a compound ZIP file and produces events.

This is the main method that a compound ZIP plugin needs to implement.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • zip_file (zipfile.ZipFile) – the ZIP file. It should not be closed in this method, but will be closed by the parser logic in czip.py.

NAME = 'czip_plugin'
Process(parser_mediator, zip_file=None, **kwargs)[source]

Determines if this is the correct plugin; if so proceed with processing.

This method checks if the ZIP file being contains the paths specified in REQUIRED_PATHS. If all paths are present, the plugin logic processing continues in InspectZipFile.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • zip_file (Optional[zipfile.ZipFile]) – the ZIP file. It should not be closed in this method, but will be closed by the parser logic in czip.py.

Raises

ValueError – If the ZIP file argument is not valid.

REQUIRED_PATHS = frozenset({})

plaso.parsers.czip_plugins.oxml module

Compound ZIP parser plugin for OpenXML files.

class plaso.parsers.czip_plugins.oxml.OpenXMLEventData[source]

Bases: plaso.containers.events.EventData

OXML event data.

app_version

version of application that created document.

Type

str

author

name of author.

Type

str

creating_app

name of application that created document.

Type

str

doc_security

???

Type

str

True if hyperlinks have changed.

Type

bool

i4

???

Type

str

last_saved_by

name of user that last saved the document.

Type

str

True if the links are up to date.

Type

bool

number_of_characters

number of characters without spaces in the document.

Type

int

number_of_characters_with_spaces

number of characters including spaces in the document.

Type

int

number_of_lines

number of lines in the document.

Type

int

number_of_pages

number of pages in the document.

Type

int

number_of_paragraphs

number of paragraphs in the document.

Type

int

number_of_words

number of words in the document.

Type

int

revision_number

revision number.

Type

int

scale_crop

True if crop to scale is enabled.

Type

bool

shared_doc

True if document is shared.

Type

bool

template

name of template ???

Type

str

total_time

???

Type

str

DATA_TYPE = 'metadata:openxml'
class plaso.parsers.czip_plugins.oxml.OpenXMLPlugin[source]

Bases: plaso.parsers.czip_plugins.interface.CompoundZIPPlugin

Parse metadata from OXML files.

DATA_FORMAT = 'OpenXML (OXML) file'
InspectZipFile(parser_mediator, zip_file)[source]

Parses an OXML file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • zip_file (zipfile.ZipFile) –

    the zip file containing OXML content. It is not be closed in this method, but will be closed by the parser logic

    in czip.py.

Raises

UnableToParseFile – when the file cannot be parsed.

NAME = 'oxml'
REQUIRED_PATHS = frozenset({'[Content_Types].xml', '_rels/.rels', 'docProps/core.xml'})

Module contents

Imports for the compound ZIP parser.