plaso.parsers.czip_plugins package
Submodules
plaso.parsers.czip_plugins.interface module
Interface for compound ZIP file plugins.
- class plaso.parsers.czip_plugins.interface.CompoundZIPPlugin[source]
Bases:
BasePlugin
Compound ZIP parser plugin.
- CheckRequiredPaths(zip_file)[source]
Checks if the ZIP file has the minimal structure required by the plugin.
- Parameters
zip_file (zipfile.ZipFile) – the ZIP file. It should not be closed in this method, but will be closed by the parser logic in czip.py.
- Returns
- True if the ZIP file has the minimum paths defined by the plugin,
or False if it does not or no required paths are defined. The ZIP file can have more paths than specified by the plugin and still return True.
- Return type
bool
- DATA_FORMAT = 'Compound ZIP file'
- NAME = 'czip_plugin'
- Process(parser_mediator, zip_file=None, **kwargs)[source]
Extracts events from the ZIP file.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
zip_file (Optional[zipfile.ZipFile]) – the ZIP file. It should not be closed in this method, but will be closed by the parser logic in czip.py.
- Raises
ValueError – If the ZIP file argument is not valid.
- REQUIRED_PATHS = frozenset({})
plaso.parsers.czip_plugins.oxml module
Compound ZIP parser plugin for OpenXML files.
- class plaso.parsers.czip_plugins.oxml.OpenXMLEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
OXML event data.
- application
name of application that created document.
- Type
str
- application_version
version of application that created document.
- Type
str
- author
name of author.
- Type
str
- creation_time
creation date and time of the document.
- Type
dfdatetime.DateTimeValues
- digital_signature
digital signature.
- Type
str
- edit_duration
total editing time.
- Type
int
- hyperlinks_changed
True if hyperlinks have changed.
- Type
bool
- last_printed_time
date and time the document was last printed.
- Type
dfdatetime.DateTimeValues
- last_saved_by
name of user that last saved the document.
- Type
str
- links_up_to_date
True if the links are up to date.
- Type
bool
- modification_time
modification date and time of the document.
- Type
dfdatetime.DateTimeValues
- number_of_characters
number of characters without spaces in the document.
- Type
int
- number_of_characters_with_spaces
number of characters including spaces in the document.
- Type
int
- number_of_clips
number of multi-media clips in the document.
- Type
int
number of hidden slides in the document.
- Type
int
- number_of_lines
number of lines in the document.
- Type
int
- number_of_pages
number of pages in the document.
- Type
int
- number_of_paragraphs
number of paragraphs in the document.
- Type
int
- number_of_slides
number of slides in the document.
- Type
int
- number_of_words
number of words in the document.
- Type
int
- revision_number
revision number.
- Type
int
- scale
True if scaling of the thumbnail is desired or false if cropping is desired.
- Type
bool
- security_flags
security flags.
- Type
int
True if document is shared.
- Type
bool
- template
name of the template used to created the document.
- Type
str
- DATA_TYPE = 'openxml:metadata'
Module contents
Imports for the compound ZIP parser.