plaso.parsers.esedb_plugins package
Submodules
plaso.parsers.esedb_plugins.file_history module
Parser for the Microsoft File History ESE database.
- class plaso.parsers.esedb_plugins.file_history.FileHistoryESEDBPlugin[source]
Bases:
ESEDBPlugin
Parses a File History ESE database file.
- DATA_FORMAT = 'Windows 8 File History ESE database file'
- NAME = 'file_history'
- ParseNameSpace(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]
Parses the namespace table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cache (Optional[ESEDBCache]) – cache.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- REQUIRED_TABLES = {'backupset': '', 'file': '', 'library': '', 'namespace': 'ParseNameSpace'}
- class plaso.parsers.esedb_plugins.file_history.FileHistoryNamespaceEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
File history namespace table event data.
- creation_time
file entry creation date and time.
- Type
dfdatetime.DateTimeValues
- file_attribute
file attribute.
- Type
int
- identifier
identifier.
- Type
str
- modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- original_filename
original file name.
- Type
str
- parent_identifier
parent identifier.
- Type
str
- usn_number
USN number.
- Type
int
- DATA_TYPE = 'windows:file_history:namespace'
plaso.parsers.esedb_plugins.interface module
This file contains the interface for ESE database plugins.
- class plaso.parsers.esedb_plugins.interface.ESEDBPlugin[source]
Bases:
BasePlugin
,DtFabricHelper
The ESE database plugin interface.
- BINARY_DATA_COLUMN_TYPES = frozenset({pyesedb.column_types.LARGE_BINARY_DATA, pyesedb.column_types.BINARY_DATA})
- CheckRequiredTables(database)[source]
Check if the database has the minimal structure required by the plugin.
- Parameters
database (ESEDatabase) – ESE database to check.
- Returns
- True if the database has the minimum tables defined by the plugin,
or False if it does not or no required tables are defined. The database can have more tables than specified by the plugin and still return True.
- Return type
bool
- DATA_FORMAT = 'ESE database file'
- FLOATING_POINT_COLUMN_TYPES = frozenset({pyesedb.column_types.FLOAT_32BIT, pyesedb.column_types.DOUBLE_64BIT})
- INTEGER_COLUMN_TYPES = frozenset({pyesedb.column_types.INTEGER_64BIT_SIGNED, pyesedb.column_types.INTEGER_8BIT_UNSIGNED, pyesedb.column_types.INTEGER_32BIT_SIGNED, pyesedb.column_types.CURRENCY, pyesedb.column_types.INTEGER_16BIT_SIGNED, pyesedb.column_types.INTEGER_32BIT_UNSIGNED, pyesedb.column_types.DATE_TIME, pyesedb.column_types.INTEGER_16BIT_UNSIGNED})
- NAME = 'esedb_plugin'
- OPTIONAL_TABLES = {}
- Process(parser_mediator, cache=None, database=None, **kwargs)[source]
Extracts events from an ESE database.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cache (Optional[ESEDBCache]) – cache.
database (Optional[ESEDatabase]) – ESE database.
- Raises
ValueError – If the database argument is not valid.
- REQUIRED_TABLES = {}
- STRING_COLUMN_TYPES = frozenset({pyesedb.column_types.LARGE_TEXT, pyesedb.column_types.TEXT})
plaso.parsers.esedb_plugins.msie_webcache module
Parser for the Microsoft Internet Explorer WebCache ESE database.
The WebCache database (WebCacheV01.dat or WebCacheV24.dat) are used by MSIE as of version 10.
- class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheContainerEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIE WebCache Container table event data.
- access_count
access count.
- Type
int
- access_time
last access date and time.
- Type
dfdatetime.DateTimeValues
- cached_filename
name of the cached file.
- Type
str
- cached_file_size
size of the cached file.
- Type
int
- cache_identifier
cache identifier.
- Type
int
- container_identifier
container identifier.
- Type
int
- creation_time
creation date and time.
- Type
dfdatetime.DateTimeValues
- entry_identifier
entry identifier.
- Type
int
- expiration_time
expiration date and time.
- Type
dfdatetime.DateTimeValues
- file_extension
file extension.
- Type
str
- modification_time
modification date and time.
- Type
dfdatetime.DateTimeValues
- post_check_time
post check date and time.
- Type
dfdatetime.DateTimeValues
- redirect_url
URL from which the request was redirected.
- Type
str
- request_headers
request headers.
- Type
str
- response_headers
response headers.
- Type
str
- synchronization_count
synchronization count.
- Type
int
- synchronization_time
synchronization date and time.
- Type
dfdatetime.DateTimeValues
- url
URL.
- Type
str
- DATA_TYPE = 'msie:webcache:container'
- class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheContainersEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIE WebCache Containers table event data.
- access_time
last access date and time.
- Type
dfdatetime.DateTimeValues
- container_identifier
container identifier.
- Type
int
- directory
name of the cache directory.
- Type
str
- name
name of the cache container.
- Type
str
- scavenge_time
last scavenge date and time.
- Type
dfdatetime.DateTimeValues
- set_identifier
set identifier.
- Type
int
- DATA_TYPE = 'msie:webcache:containers'
- class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheCookieData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIE WebCache Container table event data.
- container_identifier
container identifier.
- Type
int
- cookie_hash
a similarity hash of the cookie contents
- Type
str
- cookie_name
name of the cookie
- Type
str
- cookie_value_raw
raw value of cookie in hex
- Type
str
- cookie_value
value of the cookie encoded in ascii
- Type
str
- entry_identifier
entry identifier.
- Type
int
- expiration_time
expiration date and time.
- Type
dfdatetime.DateTimeValues
- flags
an representation of cookie flags
- Type
int
- modification_time
modification date and time.
- Type
dfdatetime.DateTimeValues
- request_domain
Request domain for which the cookie was set.
- Type
str
- DATA_TYPE = 'msie:webcache:cookie'
- class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheESEDBPlugin[source]
Bases:
ESEDBPlugin
Parses a MSIE WebCache ESE database file.
- DATA_FORMAT = 'Internet Explorer WebCache ESE database (WebCacheV01.dat, WebCacheV24.dat) file'
- GetRawCookieValue(record_values, value_name)[source]
Retrieves the binary string as a hexadecimal formatted string.
- Parameters
record_values (dict[str, object]) – values per column name.
value_name (str) – the name of the value we are converting
- Returns
the hexadecimal formatted binary string or None if not available.
- Return type
str
- NAME = 'msie_webcache'
- OPTIONAL_TABLES = {'Partitions': 'ParsePartitionsTable', 'PartitionsEx': 'ParsePartitionsTable'}
- ParseContainersTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a Containers table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- ParseLeakFilesTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a LeakFiles table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- ParsePartitionsTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a Partitions or PartitionsEx table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- REQUIRED_TABLES = {'Containers': 'ParseContainersTable', 'LeakFiles': 'ParseLeakFilesTable'}
- class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCacheLeakFilesEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIE WebCache LeakFiles event data.
- cached_filename
name of the cached file.
- Type
str
- creation_time
creation date and time.
- Type
dfdatetime.DateTimeValues
- leak_identifier
leak identifier.
- Type
int
- DATA_TYPE = 'msie:webcache:leak_file'
- class plaso.parsers.esedb_plugins.msie_webcache.MsieWebCachePartitionsEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIE WebCache Partitions table event data.
- directory
directory.
- Type
str
- partition_identifier
partition identifier.
- Type
int
- partition_type
partition type.
- Type
int
- scavenge_time
last scavenge date and time.
- Type
dfdatetime.DateTimeValues
- table_identifier
table identifier.
- Type
int
- DATA_TYPE = 'msie:webcache:partitions'
plaso.parsers.esedb_plugins.srum module
Parser for the System Resource Usage Monitor (SRUM) ESE database.
- class plaso.parsers.esedb_plugins.srum.SRUMApplicationResourceUsageEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
SRUM application resource usage event data.
Note that the interpretation of some of these values is undocumented as far as currently known.
- application
application.
- Type
str
- background_bytes_read
background number of bytes read.
- Type
int
- background_bytes_written
background number of bytes written.
- Type
int
- background_context_switches
number of background context switches.
- Type
int
- background_cycle_time
background cycle time.
- Type
int
- background_number_for_flushes
background number of flushes.
- Type
int
- background_number_for_read_operations
background number of read operations.
- Type
int
- background_number_for_write_operations
background number of write operations.
- Type
int
- face_time
face time.
- Type
int
- foreground_bytes_read
foreground number of bytes read.
- Type
int
- foreground_bytes_written
foreground number of bytes written.
- Type
int
- foreground_context_switches
number of foreground context switches.
- Type
int
- foreground_cycle_time
foreground cycle time.
- Type
int
- foreground_number_for_flushes
foreground number of flushes.
- Type
int
- foreground_number_for_read_operations
foreground number of read operations.
- Type
int
- foreground_number_for_write_operations
foreground number of write operations.
- Type
int
- identifier
record identifier.
- Type
int
- recorded_time
date and time the sample was recorded.
- Type
dfdatetime.DateTimeValues
- user_identifier
user identifier, which is a Windows NT security identifier.
- Type
str
- DATA_TYPE = 'windows:srum:application_usage'
- class plaso.parsers.esedb_plugins.srum.SRUMNetworkConnectivityUsageEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
SRUM network connectivity usage event data.
Note that the interpretation of some of these values is undocumented as far as currently known.
- application
application.
- Type
str
- identifier
record identifier.
- Type
int
- interface_luid
interface locally unique identifier (LUID).
- Type
int
- last_connected_time
last date and time the connection was established.
- Type
dfdatetime.DateTimeValues
- l2_profile_flags
L2 profile flags.
- Type
int
- l2_profile_identifier
L2 profile identifier.
- Type
int
- recorded_time
date and time the sample was recorded.
- Type
dfdatetime.DateTimeValues
- user_identifier
user identifier, which is a Windows NT security identifier.
- Type
str
- DATA_TYPE = 'windows:srum:network_connectivity'
- class plaso.parsers.esedb_plugins.srum.SRUMNetworkDataUsageEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
SRUM network data usage event data.
Note that the interpretation of some of these values is undocumented as far as currently known.
- application
application.
- Type
str
- bytes_received
number of bytes received.
- Type
int
- bytes_sent
number of bytes sent.
- Type
int
- identifier
record identifier.
- Type
int
- interface_luid
interface locally unique identifier (LUID).
- Type
int
- l2_profile_flags
L2 profile flags.
- Type
int
- l2_profile_identifier
L2 profile identifier.
- Type
int
- recorded_time
date and time the sample was recorded.
- Type
dfdatetime.DateTimeValues
- user_identifier
user identifier, which is a Windows NT security identifier.
- Type
str
- DATA_TYPE = 'windows:srum:network_usage'
- class plaso.parsers.esedb_plugins.srum.SystemResourceUsageMonitorESEDBPlugin[source]
Bases:
ESEDBPlugin
Parses a System Resource Usage Monitor (SRUM) ESE database file.
- DATA_FORMAT = 'System Resource Usage Monitor (SRUM) ESE database file'
- NAME = 'srum'
- OPTIONAL_TABLES = {'{973F5D5C-1D90-4944-BE8E-24B94231A174}': 'ParseNetworkDataUsage', '{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}': 'ParseApplicationResourceUsage', '{DD6636C4-8929-4683-974E-22C046A43763}': 'ParseNetworkConnectivityUsage'}
- ParseApplicationResourceUsage(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]
Parses the application resource usage table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cache (Optional[ESEDBCache]) – cache, which contains information about the identifiers stored in the SruDbIdMapTable table.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- ParseNetworkConnectivityUsage(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]
Parses the network connectivity usage monitor table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cache (Optional[ESEDBCache]) – cache, which contains information about the identifiers stored in the SruDbIdMapTable table.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- ParseNetworkDataUsage(parser_mediator, cache=None, database=None, table=None, **unused_kwargs)[source]
Parses the network data usage monitor table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
cache (Optional[ESEDBCache]) – cache, which contains information about the identifiers stored in the SruDbIdMapTable table.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- REQUIRED_TABLES = {'SruDbIdMapTable': ''}
plaso.parsers.esedb_plugins.user_access_logging module
Parser for the Microsoft User Access Logging (UAL) ESE database.
User Access Logging (UAL) is present in Windows Server editions starting with Window Server 2012.
- class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingClientsEventsData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows User Access Logging CLIENTS table event data.
- access_time
last access date and time.
- Type
dfdatetime.DateTimeValues
- authenticated_username
domain/user account name performing the access.
- Type
str
- client_name
client name, use unknown.
- Type
str
- insert_time
date and time the entry was first inserted into the table.
- Type
dfdatetime.DateTimeValues
- role_identifier
identifier of the service accessed.
- Type
str
- role_name
Name of the service accessed.
- Type
str
- source_ip_address
source IP address.
- Type
str
- tenant_identifier
unique identifier of a tenant client.
- Type
str
- total_accesses
Count of accesses for the year.
- Type
int
- DATA_TYPE = 'windows:user_access_logging:clients'
- class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingDNSEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows User Access Logging DNS table event data.
- hostname
hostname.
- Type
str
- ip_address
IP address.
- Type
str
- last_seen_time
date and time the hostname to IP address mapping was last observed.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:user_access_logging:dns'
- class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingESEDBPlugin[source]
Bases:
ESEDBPlugin
Parses Windows User Access Logging ESE database file.
- DATA_FORMAT = 'Windows User Access Logging ESE database file'
- NAME = 'user_access_logging'
- ParseClientsTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a CLIENTS table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- ParseDNSTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a DNS table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- ParseRoleAccessTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a ROLE_ACCESS table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- ParseVirtualMachinesTable(parser_mediator, database=None, table=None, **unused_kwargs)[source]
Parses a VIRTUALMACHINES table.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
database (Optional[ESEDatabase]) – ESE database.
table (Optional[pyesedb.table]) – table.
- Raises
ValueError – if the database or table value is missing.
- REQUIRED_TABLES = {'CLIENTS': 'ParseClientsTable', 'DNS': 'ParseDNSTable', 'ROLE_ACCESS': 'ParseRoleAccessTable', 'VIRTUALMACHINES': 'ParseVirtualMachinesTable'}
- class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingRoleAccessEventsData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows User Access Logging ROLE_ACCESS table event data.
- first_seen_time
date and time the role was first observed to be used.
- Type
dfdatetime.DateTimeValues
- last_seen_time
date and time the role was last observed to be used.
- Type
dfdatetime.DateTimeValues
- role_identifier
identifier of the role.
- Type
str
- role_name
name of the role.
- Type
str
- DATA_TYPE = 'windows:user_access_logging:role_access'
- class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingSystemIdentityEventdata(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows User Access Logging SYSTEM_IDENTITY table event data.
- creation_time
date and time the system identity was created.
- Type
dfdatetime.DateTimeValues
- operating_system_build
operating system build.
- Type
int
- system_dns_hostname
System hostname.
- Type
str
- system_domain_name
System domain name.
- Type
str
- DATA_TYPE = 'windows:user_access_logging:system_identity'
- class plaso.parsers.esedb_plugins.user_access_logging.UserAccessLoggingVirtualMachinesEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows User Access Logging VIRTUALMACHINES table event data.
- bios_identifier
BIOS identifier.
- Type
str
- creation_time
date and time the virtual machine was created.
- Type
dfdatetime.DateTimeValues
- last_active_time
date and time the virtual machine was last observed to be active.
- Type
dfdatetime.DateTimeValues
- serial_number
Serial number.
- Type
str
- vm_identifier
identifier of the virtual machine.
- Type
str
- DATA_TYPE = 'windows:user_access_logging:virtual_machines'
Module contents
Imports for the ESE database parser.