plaso.parsers.esedb_plugins package

Submodules

plaso.parsers.esedb_plugins.file_history module

Parser for the Microsoft File History ESE database.

class plaso.parsers.esedb_plugins.file_history.FileHistoryESEDBPlugin[source]

Bases: ESEDBPlugin

Parses a File History ESE database file.

DATA_FORMAT = 'Windows 8 File History ESE database file'
NAME = 'file_history'
ParseNameSpace(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]

Parses the namespace table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • cache (Optional[ESEDBCache]) – cache.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

REQUIRED_TABLES = {'backupset': '', 'file': '', 'library': '', 'namespace': 'ParseNameSpace'}
class plaso.parsers.esedb_plugins.file_history.FileHistoryNamespaceEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

File history namespace table event data.

creation_time

file entry creation date and time.

Type:

dfdatetime.DateTimeValues

file_attribute

file attribute.

Type:

int

identifier

identifier.

Type:

str

modification_time

file entry last modification date and time.

Type:

dfdatetime.DateTimeValues

original_filename

original file name.

Type:

str

parent_identifier

parent identifier.

Type:

str

usn_number

USN number.

Type:

int

DATA_TYPE = 'windows:file_history:namespace'
__init__()[source]

Initializes event data.

plaso.parsers.esedb_plugins.interface module

This file contains the interface for ESE database plugins.

class plaso.parsers.esedb_plugins.interface.ESEDBPlugin[source]

Bases: BasePlugin, DtFabricHelper

The ESE database plugin interface.

BINARY_DATA_COLUMN_TYPES = frozenset({pyesedb.column_types.BINARY_DATA, pyesedb.column_types.LARGE_BINARY_DATA})
CheckRequiredTables(database)[source]

Check if the database has the minimal structure required by the plugin.

Parameters:

database (ESEDatabase) – ESE database to check.

Returns:

True if the database has the minimum tables defined by the plugin,

or False if it does not or no required tables are defined. The database can have more tables than specified by the plugin and still return True.

Return type:

bool

DATA_FORMAT = 'ESE database file'
FLOATING_POINT_COLUMN_TYPES = frozenset({pyesedb.column_types.DOUBLE_64BIT, pyesedb.column_types.FLOAT_32BIT})
INTEGER_COLUMN_TYPES = frozenset({pyesedb.column_types.CURRENCY, pyesedb.column_types.DATE_TIME, pyesedb.column_types.INTEGER_16BIT_SIGNED, pyesedb.column_types.INTEGER_16BIT_UNSIGNED, pyesedb.column_types.INTEGER_32BIT_SIGNED, pyesedb.column_types.INTEGER_32BIT_UNSIGNED, pyesedb.column_types.INTEGER_64BIT_SIGNED, pyesedb.column_types.INTEGER_8BIT_UNSIGNED})
NAME = 'esedb_plugin'
OPTIONAL_TABLES = {}
Process(parser_mediator, cache=None, database=None, **kwargs)[source]

Extracts events from an ESE database.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • cache (Optional[ESEDBCache]) – cache.

  • database (Optional[ESEDatabase]) – ESE database.

Raises:

ValueError – If the database argument is not valid.

REQUIRED_TABLES = {}
STRING_COLUMN_TYPES = frozenset({pyesedb.column_types.LARGE_TEXT, pyesedb.column_types.TEXT})
__init__()[source]

Initializes the ESE database plugin.

plaso.parsers.esedb_plugins.msie_webcache module

Parser for the Microsoft Internet Explorer WebCache ESE database.

The WebCache database (WebCacheV01.dat or WebCacheV24.dat) are used by MSIE as of version 10.

class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheContainerEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIE WebCache Container table event data.

access_count

access count.

Type:

int

access_time

last access date and time.

Type:

dfdatetime.DateTimeValues

cached_filename

name of the cached file.

Type:

str

cached_file_size

size of the cached file.

Type:

int

cache_identifier

cache identifier.

Type:

int

container_identifier

container identifier.

Type:

int

creation_time

creation date and time.

Type:

dfdatetime.DateTimeValues

entry_identifier

entry identifier.

Type:

int

expiration_time

expiration date and time.

Type:

dfdatetime.DateTimeValues

file_extension

file extension.

Type:

str

modification_time

modification date and time.

Type:

dfdatetime.DateTimeValues

post_check_time

post check date and time.

Type:

dfdatetime.DateTimeValues

redirect_url

URL from which the request was redirected.

Type:

str

request_headers

request headers.

Type:

str

response_headers

response headers.

Type:

str

synchronization_count

synchronization count.

Type:

int

synchronization_time

synchronization date and time.

Type:

dfdatetime.DateTimeValues

url

URL.

Type:

str

DATA_TYPE = 'msie:webcache:container'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheContainersEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIE WebCache Containers table event data.

access_time

last access date and time.

Type:

dfdatetime.DateTimeValues

container_identifier

container identifier.

Type:

int

directory

name of the cache directory.

Type:

str

name

name of the cache container.

Type:

str

scavenge_time

last scavenge date and time.

Type:

dfdatetime.DateTimeValues

set_identifier

set identifier.

Type:

int

DATA_TYPE = 'msie:webcache:containers'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheCookieData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIE WebCache Container table event data.

container_identifier

container identifier.

Type:

int

cookie_hash

a similarity hash of the cookie contents

Type:

str

cookie_name

name of the cookie

Type:

str

cookie_value_raw

raw value of cookie in hex

Type:

str

cookie_value

value of the cookie encoded in ascii

Type:

str

entry_identifier

entry identifier.

Type:

int

expiration_time

expiration date and time.

Type:

dfdatetime.DateTimeValues

flags

an representation of cookie flags

Type:

int

modification_time

modification date and time.

Type:

dfdatetime.DateTimeValues

request_domain

Request domain for which the cookie was set.

Type:

str

DATA_TYPE = 'msie:webcache:cookie'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheESEDBPlugin[source]

Bases: ESEDBPlugin

Parses a MSIE WebCache ESE database file.

DATA_FORMAT = 'Internet Explorer WebCache ESE database (WebCacheV01.dat, WebCacheV24.dat) file'
GetRawCookieValue(record_values, value_name)[source]

Retrieves the binary string as a hexadecimal formatted string.

Parameters:
  • record_values (dict[str, object]) – values per column name.

  • value_name (str) – the name of the value we are converting

Returns:

the hexadecimal formatted binary string or None if not available.

Return type:

str

NAME = 'msie_webcache'
OPTIONAL_TABLES = {'Partitions': 'ParsePartitionsTable', 'PartitionsEx': 'ParsePartitionsTable'}
ParseContainersTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a Containers table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

ParseLeakFilesTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a LeakFiles table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

ParsePartitionsTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a Partitions or PartitionsEx table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

REQUIRED_TABLES = {'Containers': 'ParseContainersTable', 'LeakFiles': 'ParseLeakFilesTable'}
class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheLeakFilesEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIE WebCache LeakFiles event data.

cached_filename

name of the cached file.

Type:

str

creation_time

creation date and time.

Type:

dfdatetime.DateTimeValues

leak_identifier

leak identifier.

Type:

int

DATA_TYPE = 'msie:webcache:leak_file'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCachePartitionsEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIE WebCache Partitions table event data.

directory

directory.

Type:

str

partition_identifier

partition identifier.

Type:

int

partition_type

partition type.

Type:

int

scavenge_time

last scavenge date and time.

Type:

dfdatetime.DateTimeValues

table_identifier

table identifier.

Type:

int

DATA_TYPE = 'msie:webcache:partitions'
__init__()[source]

Initializes event data.

plaso.parsers.esedb_plugins.srum module

Parser for the System Resource Usage Monitor (SRUM) ESE database.

class plaso.parsers.esedb_plugins.srum.SRUMApplicationResourceUsageEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

SRUM application resource usage event data.

Note that the interpretation of some of these values is undocumented as far as currently known.

application

application.

Type:

str

background_bytes_read

background number of bytes read.

Type:

int

background_bytes_written

background number of bytes written.

Type:

int

background_context_switches

number of background context switches.

Type:

int

background_cycle_time

background cycle time.

Type:

int

background_number_for_flushes

background number of flushes.

Type:

int

background_number_for_read_operations

background number of read operations.

Type:

int

background_number_for_write_operations

background number of write operations.

Type:

int

face_time

face time.

Type:

int

foreground_bytes_read

foreground number of bytes read.

Type:

int

foreground_bytes_written

foreground number of bytes written.

Type:

int

foreground_context_switches

number of foreground context switches.

Type:

int

foreground_cycle_time

foreground cycle time.

Type:

int

foreground_number_for_flushes

foreground number of flushes.

Type:

int

foreground_number_for_read_operations

foreground number of read operations.

Type:

int

foreground_number_for_write_operations

foreground number of write operations.

Type:

int

identifier

record identifier.

Type:

int

recorded_time

date and time the sample was recorded.

Type:

dfdatetime.DateTimeValues

user_identifier

user identifier, which is a Windows NT security identifier.

Type:

str

DATA_TYPE = 'windows:srum:application_usage'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.srum.SRUMNetworkConnectivityUsageEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

SRUM network connectivity usage event data.

Note that the interpretation of some of these values is undocumented as far as currently known.

application

application.

Type:

str

identifier

record identifier.

Type:

int

interface_luid

interface locally unique identifier (LUID).

Type:

int

last_connected_time

last date and time the connection was established.

Type:

dfdatetime.DateTimeValues

l2_profile_flags

L2 profile flags.

Type:

int

l2_profile_identifier

L2 profile identifier.

Type:

int

recorded_time

date and time the sample was recorded.

Type:

dfdatetime.DateTimeValues

user_identifier

user identifier, which is a Windows NT security identifier.

Type:

str

DATA_TYPE = 'windows:srum:network_connectivity'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.srum.SRUMNetworkDataUsageEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

SRUM network data usage event data.

Note that the interpretation of some of these values is undocumented as far as currently known.

application

application.

Type:

str

bytes_received

number of bytes received.

Type:

int

bytes_sent

number of bytes sent.

Type:

int

identifier

record identifier.

Type:

int

interface_luid

interface locally unique identifier (LUID).

Type:

int

l2_profile_flags

L2 profile flags.

Type:

int

l2_profile_identifier

L2 profile identifier.

Type:

int

recorded_time

date and time the sample was recorded.

Type:

dfdatetime.DateTimeValues

user_identifier

user identifier, which is a Windows NT security identifier.

Type:

str

DATA_TYPE = 'windows:srum:network_usage'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.srum.SystemResourceUsageMonitorESEDBPlugin[source]

Bases: ESEDBPlugin

Parses a System Resource Usage Monitor (SRUM) ESE database file.

DATA_FORMAT = 'System Resource Usage Monitor (SRUM) ESE database file'
NAME = 'srum'
OPTIONAL_TABLES = {'{973F5D5C-1D90-4944-BE8E-24B94231A174}': 'ParseNetworkDataUsage', '{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}': 'ParseApplicationResourceUsage', '{DD6636C4-8929-4683-974E-22C046A43763}': 'ParseNetworkConnectivityUsage'}
ParseApplicationResourceUsage(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]

Parses the application resource usage table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • cache (Optional[ESEDBCache]) – cache, which contains information about the identifiers stored in the SruDbIdMapTable table.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

ParseNetworkConnectivityUsage(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]

Parses the network connectivity usage monitor table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • cache (Optional[ESEDBCache]) – cache, which contains information about the identifiers stored in the SruDbIdMapTable table.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

ParseNetworkDataUsage(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]

Parses the network data usage monitor table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • cache (Optional[ESEDBCache]) – cache, which contains information about the identifiers stored in the SruDbIdMapTable table.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

REQUIRED_TABLES = {'SruDbIdMapTable': ''}

plaso.parsers.esedb_plugins.user_access_logging module

Parser for the Microsoft User Access Logging (UAL) ESE database.

User Access Logging (UAL) is present in Windows Server editions starting with Window Server 2012.

Also see:

https://www.crowdstrike.com/blog/user-access-logging-ual-overview/

class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingClientsEventsData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows User Access Logging CLIENTS table event data.

access_time

last access date and time.

Type:

dfdatetime.DateTimeValues

authenticated_username

domain/user account name performing the access.

Type:

str

client_name

client name, use unknown.

Type:

str

insert_time

date and time the entry was first inserted into the table.

Type:

dfdatetime.DateTimeValues

role_identifier

identifier of the service accessed.

Type:

str

role_name

Name of the service accessed.

Type:

str

source_ip_address

source IP address.

Type:

str

tenant_identifier

unique identifier of a tenant client.

Type:

str

total_accesses

Count of accesses for the year.

Type:

int

DATA_TYPE = 'windows:user_access_logging:clients'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingDNSEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows User Access Logging DNS table event data.

hostname

hostname.

Type:

str

ip_address

IP address.

Type:

str

last_seen_time

date and time the hostname to IP address mapping was last observed.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:user_access_logging:dns'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingESEDBPlugin[source]

Bases: ESEDBPlugin

Parses Windows User Access Logging ESE database file.

DATA_FORMAT = 'Windows User Access Logging ESE database file'
NAME = 'user_access_logging'
ParseClientsTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a CLIENTS table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

ParseDNSTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a DNS table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

ParseRoleAccessTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a ROLE_ACCESS table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

ParseVirtualMachinesTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]

Parses a VIRTUALMACHINES table.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • database (Optional[ESEDatabase]) – ESE database.

  • table (Optional[pyesedb.table]) – table.

Raises:

ValueError – if the database or table value is missing.

REQUIRED_TABLES = {'CLIENTS': 'ParseClientsTable', 'DNS': 'ParseDNSTable', 'ROLE_ACCESS': 'ParseRoleAccessTable', 'VIRTUALMACHINES': 'ParseVirtualMachinesTable'}
__init__()[source]

Initializes an UAL ESE database file parser plugin.

class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingRoleAccessEventsData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows User Access Logging ROLE_ACCESS table event data.

first_seen_time

date and time the role was first observed to be used.

Type:

dfdatetime.DateTimeValues

last_seen_time

date and time the role was last observed to be used.

Type:

dfdatetime.DateTimeValues

role_identifier

identifier of the role.

Type:

str

role_name

name of the role.

Type:

str

DATA_TYPE = 'windows:user_access_logging:role_access'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingSystemIdentityEventdata(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows User Access Logging SYSTEM_IDENTITY table event data.

creation_time

date and time the system identity was created.

Type:

dfdatetime.DateTimeValues

operating_system_build

operating system build.

Type:

int

system_dns_hostname

System hostname.

Type:

str

system_domain_name

System domain name.

Type:

str

DATA_TYPE = 'windows:user_access_logging:system_identity'
__init__()[source]

Initializes event data.

class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingVirtualMachinesEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows User Access Logging VIRTUALMACHINES table event data.

bios_identifier

BIOS identifier.

Type:

str

creation_time

date and time the virtual machine was created.

Type:

dfdatetime.DateTimeValues

last_active_time

date and time the virtual machine was last observed to be active.

Type:

dfdatetime.DateTimeValues

serial_number

Serial number.

Type:

str

vm_identifier

identifier of the virtual machine.

Type:

str

DATA_TYPE = 'windows:user_access_logging:virtual_machines'
__init__()[source]

Initializes event data.

Module contents

Imports for the ESE database parser.