plaso.parsers package

Subpackages

Submodules

plaso.parsers.android_app_usage module

Parser for the Android usage history (usage-history.xml) files.

class plaso.parsers.android_app_usage.AndroidAppUsageEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Android application usage event data.

component

name of the individual component of the application.

Type

str

last_resume_time

date and time the application was last resumed.

Type

dfdatetime.DateTimeValues

package

name of the Android application.

Type

str

DATA_TYPE = 'android:app_usage'
class plaso.parsers.android_app_usage.AndroidAppUsageParser[source]

Bases: FileObjectParser

Parses the Android usage history (usage-history.xml) file.

DATA_FORMAT = 'Android usage history (usage-history.xml) file'
NAME = 'android_app_usage'
ParseFileObject(parser_mediator, file_object)[source]

Parses an Android usage-history file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.asl module

The Apple System Log (ASL) file parser.

class plaso.parsers.asl.ASLEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Apple System Log (ASL) event data.

computer_name

name of the host.

Type

str

extra_information

extra fields associated to the event.

Type

str

facility

facility.

Type

str

group_identifier

group identifier (GID).

Type

int

level

level of criticality of the event.

Type

str

message

message of the event.

Type

str

message_identifier

message identifier.

Type

int

process_identifier

process identifier (PID).

Type

int

read_group_identifier

the group identifier that can read this file, where -1 represents all.

Type

int

read_user_identifier

user identifier that can read this file, where -1 represents all.

Type

int

record_position

position of the event record.

Type

int

sender

sender or process that created the event.

Type

str

user_identifier

user identifier (UID).

Type

int

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'macos:asl:entry'
class plaso.parsers.asl.ASLFileEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Apple System Log (ASL) file event data.

creation_time

creation date and time.

Type

dfdatetime.DateTimeValues

format_version

ASL file format version.

Type

int

is_dirty

True if the last log entry offset does not match value in file header and the file is considered dirty.

Type

bool

DATA_TYPE = 'macos:asl:file'
class plaso.parsers.asl.ASLParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Apple System Log (ASL) files.

DATA_FORMAT = 'Apple System Log (ASL) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'asl_log'
ParseFileObject(parser_mediator, file_object)[source]

Parses an ASL file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.bencode_parser module

Parser for bencoded files.

class plaso.parsers.bencode_parser.BencodeFile[source]

Bases: object

Bencode file.

Close()[source]

Closes the file.

GetValues()[source]

Retrieves the values in the root of the bencode file.

Returns

values.

Return type

BencodeValues

IsEmpty()[source]

Determines if the bencode file has no values (is empty).

Returns

True if the bencode file is empty, False otherwise.

Return type

bool

Open(file_object)[source]

Opens a bencode file.

Parameters

file_object (dfvfs.FileIO) – file-like object.

Raises
  • IOError – if the file-like object cannot be read.

  • OSError – if the file-like object cannot be read.

  • ValueError – if the file-like object is missing.

property keys

names of all the keys.

Type

set[str]

class plaso.parsers.bencode_parser.BencodeParser[source]

Bases: FileObjectParser

Parser for bencoded files.

DATA_FORMAT = 'Bencoded file'
NAME = 'bencode'
ParseFileObject(parser_mediator, file_object)[source]

Parses a bencoded file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.bencode_parser.BencodeValues(decoded_values)[source]

Bases: object

Bencode values.

GetDateTimeValue(name)[source]

Retrieves a date and time value.

Parameters

name (str) – name of the value.

Returns

date and time or None if not available.

Return type

dfdatetime.PosixTime

GetDecodedValue(name)[source]

Retrieves a decoded value.

Parameters

name (str) – name of the value.

Returns

decoded value or None if not available.

Return type

object

GetValues()[source]

Retrieves the values.

Yields

tuple[str, object] – name and decoded value.

plaso.parsers.bodyfile module

Parser for the Sleuthkit (TSK) bodyfile format.

Sleuthkit version 3 format: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime 0|/lost+found|11|d/drwx——|0|0|12288|1337961350|1337961350|1337961350|0

More information about the format specifications can be read here:

https://forensics.wiki/bodyfile

class plaso.parsers.bodyfile.BodyfileEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Bodyfile event data.

access_time

file entry last access date and time.

Type

dfdatetime.DateTimeValues

change_time

file entry inode change (or metadata last modification) date and time.

Type

dfdatetime.DateTimeValues

creation_time

file entry creation date and time.

Type

dfdatetime.DateTimeValues

filename

name of the file.

Type

str

group_identifier

group identifier (GID), equivalent to st_gid.

Type

int

inode

“inode” of the file. Note that inode is an overloaded term in the context of a bodyfile and used for MFT entry index values as well.

Type

int

md5

MD5 hash of the file content, formatted as a hexadecimal string.

Type

str

mode_as_string

protection mode.

Type

str

modification_time

file entry last modification date and time.

Type

dfdatetime.DateTimeValues

offset

number of the corresponding line, from which the event data was extracted.

Type

int

owner_identifier

user identifier (UID or SID) of the owner.

Type

str

size

size of the file content.

Type

int

path of the symbolic link target.

Type

str

DATA_TYPE = 'fs:bodyfile:entry'
class plaso.parsers.bodyfile.BodyfileParser[source]

Bases: FileObjectParser

SleuthKit bodyfile parser.

DATA_FORMAT = 'SleuthKit version 3 bodyfile'
NAME = 'bodyfile'
ParseFileObject(parser_mediator, file_object)[source]

Parses a bodyfile file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.bsm module

Basic Security Module (BSM) event auditing file parser.

class plaso.parsers.bsm.BSMEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Basic Security Module (BSM) audit event data.

event_type

identifier that represents the type of the event.

Type

int

extra_tokens

event extra tokens, which is a list of dictionaries that contain: {token type: {token values}}

Type

list[dict[str, dict[str, str]]]

offset

offset of the BSM record relative to the start of the file, from which the event data was extracted.

Type

int

record_length

record length in bytes (trailer number).

Type

int

return_value

processed return value and exit status.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'bsm:entry'
class plaso.parsers.bsm.BSMParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Basic Security Module (BSM) event auditing files.

DATA_FORMAT = 'Basic Security Module (BSM) event auditing file'
NAME = 'bsm_log'
ParseFileObject(parser_mediator, file_object)[source]

Parses a BSM file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.chrome_cache module

Parser for Google Chrome and Chromium Cache files.

class plaso.parsers.chrome_cache.CacheAddress(cache_address)[source]

Bases: object

Chrome cache address.

block_number

block data file number.

Type

int

block_offset

offset within the block data file.

Type

int

block_size

block size.

Type

int

filename

name of the block data file.

Type

str

value

cache address.

Type

int

FILE_TYPE_BLOCK_1024 = 3
FILE_TYPE_BLOCK_256 = 2
FILE_TYPE_BLOCK_4096 = 4
FILE_TYPE_BLOCK_RANKINGS = 1
FILE_TYPE_SEPARATE = 0
class plaso.parsers.chrome_cache.CacheEntry[source]

Bases: object

Chrome cache entry.

creation_time

creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.

Type

int

hash

super fast hash of the key.

Type

int

key

key.

Type

bytes

next

cache address of the next cache entry.

Type

int

original_url

original URL derived from the key.

Type

str

rankings_node

cache address of the rankings node.

Type

int

class plaso.parsers.chrome_cache.ChromeCacheDataBlockFileParser[source]

Bases: FileObjectParser, DtFabricHelper

Chrome cache data block file parser.

ParseCacheEntry(file_object, block_offset)[source]

Parses a cache entry.

Parameters
  • file_object (dfvfs.FileIO) – a file-like object to read from.

  • block_offset (int) – block offset of the cache entry.

Returns

cache entry.

Return type

CacheEntry

Raises

ParseError – if the cache entry cannot be read.

ParseFileObject(parser_mediator, file_object)[source]

Parses a file-like object.

Parameters
  • parser_mediator (ParserMediator) – a parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object to parse.

Raises

ParseError – when the file cannot be parsed.

class plaso.parsers.chrome_cache.ChromeCacheEntryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Chrome Cache event data.

creation_time

creation date and time of the cache entry.

Type

dfdatetime.DateTimeValues

original_url

original URL.

Type

str

DATA_TYPE = 'chrome:cache:entry'
class plaso.parsers.chrome_cache.ChromeCacheIndexFileParser[source]

Bases: FileObjectParser, DtFabricHelper

Chrome cache index file parser.

creation_time

creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.

Type

int

index_table

the cache addresses which are stored in the index file.

Type

list[CacheAddress]

ParseFileObject(parser_mediator, file_object)[source]

Parses a file-like object.

Parameters
  • parser_mediator (ParserMediator) – a parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object to parse.

Raises

ParseError – when the file cannot be parsed.

class plaso.parsers.chrome_cache.ChromeCacheParser[source]

Bases: FileEntryParser

Parses Chrome Cache files.

DATA_FORMAT = 'Google Chrome or Chromium Cache file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'chrome_cache'
ParseFileEntry(parser_mediator, file_entry)[source]

Parses Chrome Cache files.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_entry (dfvfs.FileEntry) – file entry.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.chrome_preferences module

A parser for the Chrome preferences file.

class plaso.parsers.chrome_preferences.ChromeContentSettingsExceptionsEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Chrome content settings exceptions event data.

last_visited_time

date and time the URL was last visited.

Type

dfdatetime.DateTimeValues

permission

permission.

Type

str

primary_url

primary URL.

Type

str

secondary_url

secondary URL.

Type

str

DATA_TYPE = 'chrome:preferences:content_settings:exceptions'
class plaso.parsers.chrome_preferences.ChromeExtensionInstallationEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Chrome extension event data.

extension_identifier

extension identifier.

Type

str

extension_name

extension name.

Type

str

installation_time

date and time the Chrome extension was installed.

Type

dfdatetime.DateTimeValues

path

path.

Type

str

DATA_TYPE = 'chrome:preferences:extension_installation'
class plaso.parsers.chrome_preferences.ChromeExtensionsAutoupdaterEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Chrome Extension Autoupdater event data.

message

message.

Type

str

recorded_time

date and time the entry was recorded.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'chrome:preferences:extensions_autoupdater'
class plaso.parsers.chrome_preferences.ChromePreferencesParser[source]

Bases: FileObjectParser

Parses Chrome Preferences files.

DATA_FORMAT = 'Google Chrome Preferences file'
NAME = 'chrome_preferences'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Chrome preferences file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

REQUIRED_KEYS = frozenset({'browser', 'extensions'})

plaso.parsers.cups_ipp module

The CUPS IPP files parser.

CUPS IPP version 1.0: * https://datatracker.ietf.org/doc/html/rfc2565 * https://datatracker.ietf.org/doc/html/rfc2566 * https://datatracker.ietf.org/doc/html/rfc2567 * https://datatracker.ietf.org/doc/html/rfc2568 * https://datatracker.ietf.org/doc/html/rfc2569 * https://datatracker.ietf.org/doc/html/rfc2639

CUPS IPP version 1.1: * https://datatracker.ietf.org/doc/html/rfc2910 * https://datatracker.ietf.org/doc/html/rfc2911 * https://datatracker.ietf.org/doc/html/rfc3196 * https://datatracker.ietf.org/doc/html/rfc3510

CUPS IPP version 2.0: * N/A

class plaso.parsers.cups_ipp.CupsIppEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

CUPS IPP event data.

application

application that prints the document.

Type

str

computer_name

name of the computer.

Type

str

copies

number of copies.

Type

int

creation_time

date and time the print job was created (added).

Type

dfdatetime.DateTimeValues

doc_type

type of document.

Type

str

end_time

date and time the print job was stopped.

Type

dfdatetime.DateTimeValues

job_id

job identifier.

Type

str

job_name

job name.

Type

str

owner

real name of the user.

Type

str

printer_id

identification name of the print.

Type

str

start_time

date and time the print job was started.

Type

dfdatetime.DateTimeValues

uri

URL of the CUPS service.

Type

str

user

system user name.

Type

str

DATA_TYPE = 'cups:ipp:event'
class plaso.parsers.cups_ipp.CupsIppParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for CUPS IPP files.

DATA_FORMAT = 'CUPS IPP file'
NAME = 'cups_ipp'
ParseFileObject(parser_mediator, file_object)[source]

Parses a CUPS IPP file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.custom_destinations module

Parser for custom destinations jump list (.customDestinations-ms) files.

class plaso.parsers.custom_destinations.CustomDestinationsParser[source]

Bases: FileObjectParser, DtFabricHelper

Parses custom destinations jump list (.customDestinations-ms) files.

DATA_FORMAT = 'Custom destinations jump list (.customDestinations-ms) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'custom_destinations'
ParseFileObject(parser_mediator, file_object)[source]

Parses a .customDestinations-ms file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.czip module

This file contains a parser for compound ZIP files.

class plaso.parsers.czip.CompoundZIPParser[source]

Bases: FileObjectParser

Shared functionality for parsing compound ZIP files.

Compound ZIP files are ZIP files used as containers to create another file format, as opposed to archives of unrelated files.

DATA_FORMAT = 'Compound ZIP file'
NAME = 'czip'
ParseFileObject(parser_mediator, file_object)[source]

Parses a compound ZIP file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.dsv_parser module

Delimiter separated values (DSV) parser interface.

class plaso.parsers.dsv_parser.DSVParser[source]

Bases: FileObjectParser

Delimiter separated values (DSV) parser interface.

COLUMNS = []
DELIMITER = ','
ESCAPE_CHARACTER = ''
FIELD_SIZE_LIMIT = 131072
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NUMBER_OF_HEADER_LINES = 0
ParseFileObject(parser_mediator, file_object)[source]

Parses a DSV text file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

abstract ParseRow(parser_mediator, row_offset, row)[source]

Parses a line of the log file and produces events.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row_offset (int) – offset of the line from which the row was extracted.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

QUOTE_CHAR = '"'
abstract VerifyRow(parser_mediator, row)[source]

Verifies if a line of the file is in the expected format.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

Returns

True if this is the correct parser, False otherwise.

Return type

bool

plaso.parsers.esedb module

Parser for Extensible Storage Engine (ESE) database files (EDB).

class plaso.parsers.esedb.ESEDBCache[source]

Bases: BasePluginCache

A cache storing query results for ESEDB plugins.

StoreDictInCache(attribute_name, dict_object)[source]

Store a dict object in cache.

Parameters
  • attribute_name (str) – name of the attribute.

  • dict_object (dict) – dictionary.

class plaso.parsers.esedb.ESEDBParser[source]

Bases: FileObjectParser

Parses Extensible Storage Engine (ESE) database files (EDB).

DATA_FORMAT = 'Extensible Storage Engine (ESE) Database File (EDB) format'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'esedb'
ParseFileObject(parser_mediator, file_object)[source]

Parses an ESE database file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

class plaso.parsers.esedb.ESEDatabase[source]

Bases: object

Extensible Storage Engine (ESE) database.

Close()[source]

Closes the database.

GetTableByName(name)[source]

Retrieves a table by its name.

Parameters

name (str) – name of the table.

Returns

the table with the corresponding name or None if there is

no table with the name.

Return type

pyesedb.table

Open(file_object)[source]

Opens an Extensible Storage Engine (ESE) database file.

Parameters

file_object (dfvfs.FileIO) – file-like object.

Raises
  • IOError – if the file-like object cannot be read.

  • OSError – if the file-like object cannot be read.

  • ValueError – if the file-like object is missing.

property tables

names of all the tables.

Type

list[str]

plaso.parsers.filestat module

File system stat object parser.

class plaso.parsers.filestat.FileStatEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

File system stat event data.

access_time

file entry last access date and time.

Type

dfdatetime.DateTimeValues

added_time

file entry added date and time.

Type

dfdatetime.DateTimeValues

attribute_names

extended attribute names.

Type

[str]

backup_time

file entry backup date and time.

Type

dfdatetime.DateTimeValues

change_time

file entry inode change (or metadata last modification) date and time.

Type

dfdatetime.DateTimeValues

creation_time

file entry creation date and time.

Type

dfdatetime.DateTimeValues

deletion_time

file entry deletion date and time.

Type

dfdatetime.DateTimeValues

display_name

display name.

Type

str

file_entry_type

dfVFS file entry type.

Type

int

file_size

file size in bytes.

Type

int

file_system_type

file system type.

Type

str

filename

name of the file.

Type

str

group_identifier

group identifier (GID), equivalent to st_gid.

Type

int

inode

inode of the file.

Type

int

is_allocated

True if the file is allocated.

Type

bool

mode

access mode, equivalent to st_mode & 0x0fff.

Type

int

modification_time

file entry last modification date and time.

Type

dfdatetime.DateTimeValues

number of hard links, equivalent to st_nlink.

Type

int

owner_identifier

user identifier (UID) of the owner, equivalent to st_uid.

Type

int

DATA_TYPE = 'fs:stat'
class plaso.parsers.filestat.FileStatParser[source]

Bases: FileEntryParser

Parses file system stat object.

DATA_FORMAT = 'file system stat information'
NAME = 'filestat'
ParseFileEntry(parser_mediator, file_entry)[source]

Parses a file entry.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_entry (dfvfs.FileEntry) – a file entry.

plaso.parsers.firefox_cache module

Implements a parser for Firefox cache 1 and 2 files.

class plaso.parsers.firefox_cache.BaseFirefoxCacheParser[source]

Bases: FileObjectParser

Parses Firefox cache files.

class plaso.parsers.firefox_cache.FirefoxCache2Parser[source]

Bases: BaseFirefoxCacheParser, DtFabricHelper

Parses Firefox cache version 2 files (Firefox 32 or later).

DATA_FORMAT = 'Mozilla Firefox Cache version 2 file (version 32 or later)'
NAME = 'firefox_cache2'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Firefox cache file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.firefox_cache.FirefoxCacheEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Firefox cache event data.

data_size

size of the cached data.

Type

int

expiration_time

date and time the cache entry expires.

Type

dfdatetime.DateTimeValues

fetch_count

number of times the cache entry was fetched.

Type

int

frequency

???

Type

int

info_size

size of the metadata.

Type

int

last_fetched_time

date and time the cache entry was last fetched.

Type

dfdatetime.DateTimeValues

last_modified_time

date and time the cache entry was last modified.

Type

dfdatetime.DateTimeValues

location

???

Type

str

request_method

HTTP request method.

Type

str

request_size

HTTP request byte size.

Type

int

response_code

HTTP response code.

Type

int

url

URL of original content.

Type

str

version

cache format version.

Type

str

DATA_TYPE = 'firefox:cache:record'
class plaso.parsers.firefox_cache.FirefoxCacheParser[source]

Bases: BaseFirefoxCacheParser, DtFabricHelper

Parses Firefox cache version 1 files (Firefox 31 or earlier).

DATA_FORMAT = 'Mozilla Firefox Cache version 1 file (version 31 or earlier)'
FIREFOX_CACHE_CONFIG

alias of firefox_cache_config

NAME = 'firefox_cache'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Firefox cache file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.fish_history module

Parser for fish history files.

class plaso.parsers.fish_history.FishHistoryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Fish history log event data.

command

command that was executed.

Type

str

written_time

date and time the entry was written.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'fish:history:entry'
class plaso.parsers.fish_history.FishHistoryParser[source]

Bases: FileObjectParser

Parses events from Fish history files.

DATA_FORMAT = 'Fish history file'
NAME = 'fish_history'
ParseFileObject(parser_mediator, file_object)[source]

Parses a fish history file from a file-like object

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.fseventsd module

Parsers for MacOS fseventsd files.

Also see:

https://github.com/libyal/dtformats/blob/main/documentation/MacOS%20File%20System%20Events%20Disk%20Log%20Stream%20format.asciidoc

class plaso.parsers.fseventsd.FseventsdEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MacOS file system event (fseventsd) event data

event_identifier

the record event identifier.

Type

int

file_entry_modification_time

file entry last modification date and time.

Type

dfdatetime.DateTimeValues

flags

flags stored in the record.

Type

int

node_identifier

file system node identifier related to the file system event.

Type

int

path

path recorded in the fseventsd record.

Type

str

DATA_TYPE = 'macos:fseventsd:record'
class plaso.parsers.fseventsd.FseventsdParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for fseventsd files.

This parser supports both version 1 and version 2 fseventsd files.

DATA_FORMAT = 'MacOS File System Events Disk Log Stream (fseventsd) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'fseventsd'
ParseFileObject(parser_mediator, file_object)[source]

Parses an fseventsd file.

Parameters
  • parser_mediator (ParserMediator) – parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the header cannot be parsed.

plaso.parsers.interface module

The parsers and plugins interface classes.

class plaso.parsers.interface.BaseFileEntryFilter[source]

Bases: object

File entry filter interface.

abstract Match(file_entry)[source]

Determines if a file entry matches the filter.

Parameters

file_entry (dfvfs.FileEntry) – a file entry.

Returns

True if the file entry matches the filter.

Return type

bool

class plaso.parsers.interface.BaseParser[source]

Bases: object

The parser interface.

ALL_PLUGINS = {'*'}
DATA_FORMAT = ''
classmethod DeregisterPlugin(plugin_class)[source]

Deregisters a plugin class.

The plugin classes are identified based on their lower case name.

Parameters

plugin_class (type) – class of the plugin.

Raises

KeyError – if plugin class is not set for the corresponding name.

EnablePlugins(plugin_includes)[source]

Enables parser plugins.

Parameters

plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.

FILTERS = frozenset({})
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

a format specification or None if not available.

Return type

FormatSpecification

classmethod GetPluginNames()[source]

Retrieves the names of registered plugins.

Returns

names of the plugins.

Return type

list[str]

classmethod GetPluginObjectByName(plugin_name)[source]

Retrieves a specific plugin object by its name.

Parameters

plugin_name (str) – name of the plugin.

Returns

a plugin object or None if not available.

Return type

BasePlugin

classmethod GetPlugins()[source]

Retrieves the registered plugins.

Yields

tuple[str, type] – name and class of the plugin.

NAME = 'base_parser'
classmethod RegisterPlugin(plugin_class)[source]

Registers a plugin class.

The plugin classes are identified based on their lower case name.

Parameters

plugin_class (type) – class of the plugin.

Raises

KeyError – if plugin class is already set for the corresponding name.

classmethod RegisterPlugins(plugin_classes)[source]

Registers plugin classes.

Parameters

plugin_classes (list[type]) – classes of plugins.

Raises

KeyError – if plugin class is already set for the corresponding name.

classmethod SupportsPlugins()[source]

Determines if a parser supports plugins.

Returns

True if the parser supports plugins.

Return type

bool

class plaso.parsers.interface.FileEntryParser[source]

Bases: BaseParser

The file entry parser interface.

Parse(parser_mediator)[source]

Parses the file entry and extracts event objects.

Parameters

parser_mediator (ParserMediator) – a parser mediator.

Raises

WrongParser – when the file cannot be parsed.

abstract ParseFileEntry(parser_mediator, file_entry)[source]

Parses a file entry.

Parameters
  • parser_mediator (ParserMediator) – a parser mediator.

  • file_entry (dfvfs.FileEntry) – a file entry to parse.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.interface.FileNameFileEntryFilter(filename)[source]

Bases: BaseFileEntryFilter

File name file entry filter.

Match(file_entry)[source]

Determines if a file entry matches the filter.

Parameters

file_entry (dfvfs.FileEntry) – a file entry.

Returns

True if the file entry matches the filter.

Return type

bool

class plaso.parsers.interface.FileObjectParser[source]

Bases: BaseParser

The file-like object parser interface.

Parse(parser_mediator, file_object)[source]

Parses a single file-like object.

Parameters
  • parser_mediator (ParserMediator) – a parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object to parse.

Raises

WrongParser – when the file cannot be parsed.

abstract ParseFileObject(parser_mediator, file_object)[source]

Parses a file-like object.

Parameters
  • parser_mediator (ParserMediator) – a parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object to parse.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.java_idx module

Parser for Java Cache IDX files.

class plaso.parsers.java_idx.JavaIDXEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Java IDX cache file event data.

downloaded_time

date and time the content was downloaded.

Type

dfdatetime.DateTimeValues

expiration_time

date and time the cached download expires.

Type

dfdatetime.DateTimeValues

idx_version

format version of IDX file.

Type

str

ip_address

IP address of the host in the URL.

Type

str

modification_time

date and time the cached download expires.

Type

dfdatetime.DateTimeValues

url

URL of the downloaded file.

Type

str

DATA_TYPE = 'java:download:idx'
class plaso.parsers.java_idx.JavaIDXParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Java WebStart Cache IDX files.

There are five structures defined. 6.02 files had one generic section that retained all data. From 6.03, the file went to a multi-section format where later sections were optional and had variable-lengths. 6.03, 6.04, and 6.05 files all have their main data section (#2) begin at offset 128. The short structure is because 6.05 files deviate after the 8th byte. So, grab the first 8 bytes to ensure it’s valid, get the file version, then continue on with the correct structures.

DATA_FORMAT = 'Java WebStart Cache IDX file'
NAME = 'java_idx'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Java WebStart Cache IDX file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object to parse.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.jsonl_parser module

Base parser for line-based JSON (JSON-L) log formats.

class plaso.parsers.jsonl_parser.JSONLParser[source]

Bases: FileObjectParser

Base parser for line-based JSON (JSON-L) log formats.

DATA_FORMAT = 'JSON-L log file'
NAME = 'jsonl'
ParseFileObject(parser_mediator, file_object)[source]

Parses a line-based JSON (JSON-L) log file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.locate module

Parser for locate database (updatedb) files.

class plaso.parsers.locate.LocateDatabaseEvent(*args: Any, **kwargs: Any)[source]

Bases: EventData

Linux locate database (updatedb) event data.

entries

contents of the locate database (updatedb) entry.

Type

list[str]

path

path of the locate database (updatedb) entry.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'linux:locate_database:entry'
class plaso.parsers.locate.LocateDatabaseParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for locate database (updatedb) files.

DATA_FORMAT = 'Locate database file (updatedb)'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'locate_database'
ParseFileObject(parser_mediator, file_object, **kwargs)[source]

Parses a locate database (updatedb) file-like object.

Parameters
  • parser_mediator (ParserMediator) – parser mediator.

  • file_object (dfvfs.FileIO) – file-like object to be parsed.

Raises

WrongParser – when the file cannot be parsed, this will signal the event extractor to apply other parsers.

plaso.parsers.logger module

The parsers sub module logger.

plaso.parsers.macos_keychain module

Parser for MacOS keychain database files.

class plaso.parsers.macos_keychain.KeychainApplicationRecordEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MacOS keychain application password record event data.

account_name

name of the account.

Type

str

comments

comments added by the user.

Type

str

creation_time

creation date and time of the keychain record.

Type

dfdatetime.DateTimeValues

entry_name

name of the entry.

Type

str

modification_time

modification date and time of the keychain record.

Type

dfdatetime.DateTimeValues

ssgp_hash

password/certificate hash formatted as a hexadecimal string.

Type

str

text_description

description.

Type

str

DATA_TYPE = 'macos:keychain:application'
class plaso.parsers.macos_keychain.KeychainDatabaseColumn[source]

Bases: object

MacOS keychain database column.

attribute_data_type

attribute (data) type.

Type

int

attribute_identifier

attribute identifier.

Type

int

attribute_name

attribute name.

Type

str

class plaso.parsers.macos_keychain.KeychainDatabaseTable[source]

Bases: object

MacOS keychain database table.

columns

columns.

Type

list[KeychainDatabaseColumn]

records

records.

Type

list[dict[str, str]]

relation_identifier

relation identifier.

Type

int

relation_name

relation name.

Type

str

class plaso.parsers.macos_keychain.KeychainInternetRecordEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MacOS keychain internet record event data.

account_name

name of the account.

Type

str

comments

comments added by the user.

Type

str

creation_time

creation date and time of the keychain record.

Type

dfdatetime.DateTimeValues

entry_name

name of the entry.

Type

str

modification_time

modification date and time of the keychain record.

Type

dfdatetime.DateTimeValues

protocol

internet protocol used, for example “https”.

Type

str

ssgp_hash

password/certificate hash formatted as a hexadecimal string.

Type

str

text_description

description.

Type

str

type_protocol

sub-protocol used, for example “form”.

Type

str

where

domain name or IP where the password is used.

Type

str

DATA_TYPE = 'macos:keychain:internet'
class plaso.parsers.macos_keychain.KeychainParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for MacOS keychain database files.

DATA_FORMAT = 'MacOS keychain database file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'mac_keychain'
ParseFileObject(parser_mediator, file_object)[source]

Parses a MacOS keychain file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.manager module

The parsers and plugins manager.

class plaso.parsers.manager.ParsersManager[source]

Bases: object

The parsers and plugins manager.

ALL_PLUGINS = {'*'}
classmethod CheckFilterExpression(parser_filter_expression)[source]

Checks parser and plugin names in a parser filter expression.

Parameters

parser_filter_expression (str) –

parser filter expression, where None represents all parsers and plugins.

A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.

This function does not support presets, and requires a parser filter expression where presets have been expanded.

Returns

containing:

  • set(str): parser filter expression elements that contain known parser

    and/or plugin names.

  • set(str): parser filter expression elements that contain unknown parser

    and/or plugin names.

Return type

tuple

classmethod CreateSignatureScanner(specification_store)[source]

Creates a signature scanner for format specifications with signatures.

Parameters

specification_store (FormatSpecificationStore) – format specifications with signatures.

Returns

signature scanner.

Return type

pysigscan.scanner

classmethod DeregisterParser(parser_class)[source]

Deregisters a parser class.

The parser classes are identified based on their lower case name.

Parameters

parser_class (type) – parser class (subclass of BaseParser).

Raises

KeyError – if parser class is not set for the corresponding name.

classmethod GetFormatsWithSignatures(parser_filter_expression=None)[source]

Retrieves the format specifications that have signatures.

This method will create a specification store for parsers that define a format specification with signatures and a list of parser names for those that do not.

Parameters

parser_filter_expression (Optional[str]) –

parser filter expression, where None represents all parsers and plugins.

A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.

This function does not support presets, and requires a parser filter expression where presets have been expanded.

Returns

containing:

  • FormatSpecificationStore: format specifications with signatures.

  • list[str]: names of parsers that do not have format specifications with

    signatures, or have signatures but also need to be applied ‘brute force’.

Return type

tuple

classmethod GetNamesOfParsersWithPlugins()[source]

Retrieves the names of all parsers with plugins.

Returns

names of all parsers with plugins.

Return type

list[str]

classmethod GetParserObjects(parser_filter_expression=None)[source]

Retrieves the parser objects.

Parameters

parser_filter_expression (Optional[str]) –

parser filter expression, where None represents all parsers and plugins.

A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.

This function does not support presets, and requires a parser filter expression where presets have been expanded.

Returns

parsers per name.

Return type

dict[str, BaseParser]

classmethod GetParserPluginsInformation(parser_filter_expression=None)[source]

Retrieves the parser plugins information.

Parameters

parser_filter_expression (Optional[str]) –

parser filter expression, where None represents all parsers and plugins.

A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.

This function does not support presets, and requires a parser filter expression where presets have been expanded.

Returns

pairs of parser plugin names and descriptions.

Return type

list[tuple[str, str]]

classmethod GetParsersInformation()[source]

Retrieves the parsers information.

Returns

parser names and descriptions.

Return type

list[tuple[str, str]]

classmethod RegisterParser(parser_class)[source]

Registers a parser class.

The parser classes are identified based on their lower case name.

Parameters

parser_class (type) – parser class (subclass of BaseParser).

Raises

KeyError – if parser class is already set for the corresponding name.

classmethod RegisterParsers(parser_classes)[source]

Registers parser classes.

The parser classes are identified based on their lower case name.

Parameters

parser_classes (list[type]) – parsers classes (subclasses of BaseParser).

Raises

KeyError – if parser class is already set for the corresponding name.

plaso.parsers.mcafeeav module

Parser for McAfee Anti-Virus Logs.

McAfee AV uses 4 logs to track when scans were run, when virus databases were updated, and when files match the virus database.

class plaso.parsers.mcafeeav.McafeeAVEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

McAfee AV Log event data.

action

action.

Type

str

filename

filename.

Type

str

offset

offset of the line relative to the start of the file, from which the event data was extracted.

Type

int

rule

rule.

Type

str

status

status.

Type

str

trigger_location

trigger location.

Type

str

username

username.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'av:mcafee:accessprotectionlog'
class plaso.parsers.mcafeeav.McafeeAccessProtectionParser[source]

Bases: DSVParser

Parses the McAfee AV Access Protection Log.

COLUMNS = ['date', 'time', 'status', 'username', 'filename', 'trigger_location', 'rule', 'action']
DATA_FORMAT = 'McAfee Anti-Virus access protection log file'
DELIMITER = '\t'
NAME = 'mcafee_protection'
ParseRow(parser_mediator, row_offset, row)[source]

Parses a line of the log file and produces events.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row_offset (int) – offset of the line from which the row was extracted.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

VerifyRow(parser_mediator, row)[source]

Verifies if a line of the file is in the expected format.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

Returns

True if this is the correct parser, False otherwise.

Return type

bool

plaso.parsers.mediator module

The parser mediator.

class plaso.parsers.mediator.ParserMediator(knowledge_base, collection_filters_helper=None, resolver_context=None)[source]

Bases: object

Parser mediator.

collection_filters_helper

collection filters helper.

Type

CollectionFiltersHelper

last_activity_timestamp

timestamp received that indicates the last time activity was observed. The last activity timestamp is updated when the mediator produces an attribute container, such as an event source. This timestamp is used by the multi processing worker process to indicate the last time the worker was known to be active. This information is then used by the foreman to detect workers that are not responding (stalled).

Type

int

parsers_counter

number of events per parser or parser plugin.

Type

collections.Counter

AddWindowsEventLogMessageFile(message_file)[source]

Adds a Windows EventLog message file.

Parameters

message_file (WindowsEventLogMessageFileArtifact) – Windows EventLog message file.

AddWindowsEventLogMessageString(message_string)[source]

Adds a Windows EventLog message string.

Parameters

message_string (WindowsEventLogMessageStringArtifact) – Windows EventLog message string.

AddWindowsWevtTemplateEvent(event_definition)[source]

Adds a Windows WEVT_TEMPLATE event definition.

Parameters

event_definition (WindowsWevtTemplateEvent) – Windows WEVT_TEMPLATE event definition.

AddYearLessLogHelper(year_less_log_helper)[source]

Adds a year-less log helper.

Parameters

year_less_log_helper (YearLessLogHelper) – year-less log helper.

AppendToParserChain(name)[source]

Adds a parser or parser plugin to the parser chain.

Parameters

name (str) – name of a parser or parser plugin.

ClearParserChain()[source]

Clears the parser chain.

ExpandWindowsPath(path)[source]

Expands a Windows path containing environment variables.

Parameters

path (str) – Windows path with environment variables.

Returns

expanded Windows path.

Return type

str

GetCurrentYear()[source]

Retrieves current year.

Returns

the current year.

Return type

int

GetDisplayName(file_entry=None)[source]

Retrieves the display name for a file entry.

Parameters

file_entry (Optional[dfvfs.FileEntry]) – file entry object, where None will return the display name of self._file_entry.

Returns

human readable string that describes the path to the file entry.

Return type

str

Raises

ValueError – if the file entry is missing.

GetDisplayNameForPathSpec(path_spec)[source]

Retrieves the display name for a path specification.

Parameters

path_spec (dfvfs.PathSpec) – path specification.

Returns

human readable version of the path specification.

Return type

str

GetFileEntry()[source]

Retrieves the active file entry.

Returns

file entry or None if not available.

Return type

dfvfs.FileEntry

GetFilename()[source]

Retrieves the name of the active file entry.

Returns

name of the active file entry or None.

Return type

str

GetParserChain()[source]

Retrieves the current parser chain.

Returns

parser chain.

Return type

str

GetRelativePath()[source]

Retrieves the relative path of the current file entry.

Returns

relative path of the current file entry or None if no current

file entry.

Return type

str

GetRelativePathForPathSpec(path_spec)[source]

Retrieves the relative path for a path specification.

Parameters

path_spec (dfvfs.PathSpec) – path specification.

Returns

relative path of the path specification.

Return type

str

GetWindowsEventLogMessageFile()[source]

Retrieves the Windows EventLog message file for a specific path.

Returns

Windows EventLog message file or None

if no current file entry or no Windows EventLog message file was found.

Return type

WindowsEventLogMessageFileArtifact

PopFromParserChain()[source]

Removes the last added parser or parser plugin from the parser chain.

ProduceEventData(event_data)[source]

Produces event data.

Parameters

event_data (EventData) – event data.

Raises

RuntimeError – when storage writer is not set.

ProduceEventDataStream(event_data_stream)[source]

Produces an event data stream.

Parameters

event_data_stream (EventDataStream) – an event data stream or None if no event data stream is needed.

Raises

RuntimeError – when storage writer is not set.

ProduceEventSource(event_source)[source]

Produces an event source.

Parameters

event_source (EventSource) – an event source.

Raises

RuntimeError – when storage writer is not set.

ProduceExtractionWarning(message, path_spec=None)[source]

Produces an extraction warning.

Parameters
  • message (str) – message of the warning.

  • path_spec (Optional[dfvfs.PathSpec]) – path specification, where None will use the path specification of current file entry set in the mediator.

Raises

RuntimeError – when storage writer is not set.

ProduceRecoveryWarning(message, path_spec=None)[source]

Produces a recovery warning.

Parameters
  • message (str) – message of the warning.

  • path_spec (Optional[dfvfs.PathSpec]) – path specification, where None will use the path specification of current file entry set in the mediator.

Raises

RuntimeError – when storage writer is not set.

ResetFileEntry()[source]

Resets the active file entry.

SampleFormatCheckStartTiming(parser_name)[source]

Starts timing a CPU time sample for profiling.

Parameters

parser_name (str) – name of the parser.

SampleFormatCheckStopTiming(parser_name)[source]

Stops timing a CPU time sample for profiling.

Parameters

parser_name (str) – name of the parser.

SampleMemoryUsage(parser_name)[source]

Takes a sample of the memory usage for profiling.

Parameters

parser_name (str) – name of the parser.

SampleStartTiming(parser_name)[source]

Starts timing a CPU time sample for profiling.

Parameters

parser_name (str) – name of the parser.

SampleStopTiming(parser_name)[source]

Stops timing a CPU time sample for profiling.

Parameters

parser_name (str) – name of the parser.

SetExtractWinEvtResources(extract_winevt_resources)[source]

Sets value to indicate if Windows EventLog resources should be extracted.

Parameters

extract_winevt_resources (bool) – True if Windows EventLog resources should be extracted.

SetFileEntry(file_entry)[source]

Sets the active file entry.

Parameters

file_entry (dfvfs.FileEntry) – file entry.

SetPreferredCodepage(codepage)[source]

Sets the preferred codepage.

Parameters

codepage (str) – codepage.

SetPreferredLanguage(language_tag)[source]

Sets the preferred language.

Parameters

language_tag (str) – language tag such as “en-US” for US English or “is-IS” for Icelandic or None if the language determined by preprocessing or the default should be used.

Raises

ValueError – if the language tag is not a string type or no LCID can be determined that corresponds with the language tag.

SetPreferredTimeZone(time_zone_string)[source]

Sets the preferred time zone for zone-less date and time values.

Parameters

time_zone_string (str) – time zone such as “Europe/Amsterdam” or None if the time zone determined by preprocessing or the default should be used.

Raises

ValueError – if the time zone is not supported.

SetStorageWriter(storage_writer)[source]

Sets the storage writer.

Parameters

storage_writer (StorageWriter) – storage writer.

SetTemporaryDirectory(temporary_directory)[source]

Sets the directory to store temporary files.

Parameters

temporary_directory (str) – path of the directory to store temporary files.

SignalAbort()[source]

Signals the parsers to abort.

StartProfiling(configuration, identifier, process_information)[source]

Starts profiling.

Parameters
  • configuration (ProfilingConfiguration) – profiling configuration.

  • identifier (str) – identifier of the profiling session used to create the sample filename.

  • process_information (ProcessInfo) – process information.

StopProfiling()[source]

Stops profiling.

property abort

True if parsing should be aborted.

Type

bool

property codepage

preferred codepage in lower case.

Type

str

property extract_winevt_resources

extract Windows EventLog resources.

Type

bool

property language

language tag in lower case.

Type

str

property number_of_produced_event_data

number of produced event data.

Type

int

property number_of_produced_event_sources

number of produced event sources.

Type

int

property number_of_produced_extraction_warnings

number of produced extraction warnings.

Type

int

property resolver_context

resolver context.

Type

dfvfs.Context

property temporary_directory

path of the directory for temporary files.

Type

str

property timezone

timezone.

Type

datetime.tzinfo

plaso.parsers.msiecf module

Parser for Microsoft Internet Explorer (MSIE) Cache Files (CF).

class plaso.parsers.msiecf.MSIECFLeakEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIECF leak event data.

cached_filename

name of the cached file.

Type

str

cached_file_size

size of the cached file.

Type

int

cache_directory_index

index of the cache directory.

Type

int

cache_directory_name

name of the cache directory.

Type

str

offset

offset of the MSIECF item relative to the start of the file, from which the event data was extracted.

Type

int

recovered

True if the item was recovered.

Type

bool

DATA_TYPE = 'msiecf:leak'
class plaso.parsers.msiecf.MSIECFParser[source]

Bases: FileObjectParser

Parses MSIE Cache Files (MSIECF).

DATA_FORMAT = 'Microsoft Internet Explorer (MSIE) 4 - 9 cache (index.dat) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'msiecf'
ParseFileObject(parser_mediator, file_object)[source]

Parses a MSIE Cache File (MSIECF) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

class plaso.parsers.msiecf.MSIECFRedirectedEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIECF redirected event data.

offset

offset of the MSIECF item relative to the start of the file, from which the event data was extracted.

Type

int

recovered

True if the item was recovered.

Type

bool

url

location URL.

Type

str

DATA_TYPE = 'msiecf:redirected'
class plaso.parsers.msiecf.MSIECFURLEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIECF URL event data.

access_time

date and time the MSIECF item was last accessed.

Type

dfdatetime.DateTimeValues

cached_filename

name of the cached file.

Type

str

cached_file_size

size of the cached file.

Type

int

cache_directory_index

index of the cache directory.

Type

int

cache_directory_name

name of the cache directory.

Type

str

creation_time

date and time the MSIECF item was created.

Type

dfdatetime.DateTimeValues

expiration_time

date and time the MSIECF item expires.

Type

dfdatetime.DateTimeValues

http_headers

HTTP headers.

Type

str

modification_time

date and time the MSIECF item was last modified.

Type

dfdatetime.DateTimeValues

last_visited_time

date and time the MSIECF item was last visited.

Type

dfdatetime.DateTimeValues

number_of_hits

number of hits.

Type

int

offset

offset of the MSIECF item relative to the start of the file, from which the event data was extracted.

Type

int

primary_time

unspecified primary date and time of the MSIECF item.

Type

dfdatetime.DateTimeValues

recovered

True if the item was recovered.

Type

bool

secondary_time

unspecified secondary date and time of the MSIECF item.

Type

dfdatetime.DateTimeValues

synchronization_time

synchronization date and time.

Type

dfdatetime.DateTimeValues

url

location URL.

Type

str

DATA_TYPE = 'msiecf:url'

plaso.parsers.networkminer module

Parser for NetworkMiner .fileinfos files.

class plaso.parsers.networkminer.NetworkMinerEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

NetworkMiner event Data.

destination_ip

Destination IP address.

Type

str

destination_port

Destination port number.

Type

str

file_details

Details about the file.

Type

string

file_md5

MD5 hash of the file.

Type

string

file_path

File path to where it was downloaded.

Type

string

file_size

Size of the file.

Type

string

filename

Name of the file.

Type

string

source_ip

Originating IP address.

Type

str

source_port

Originating port number.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'networkminer:fileinfos:file'
class plaso.parsers.networkminer.NetworkMinerParser[source]

Bases: DSVParser

Parser for NetworkMiner .fileinfos files.

COLUMNS = ('source_ip', 'source_port', 'destination_ip', 'destination_port', 'filename', 'file_path', 'file_size', 'unused', 'file_md5', 'unused2', 'file_details', 'unused4', 'timestamp')
DATA_FORMAT = 'NetworkMiner .fileinfos file'
NAME = 'networkminer_fileinfo'
ParseRow(parser_mediator, row_offset, row)[source]

Parses a line of the log file and produces events.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • row_offset (int) – line number of the row.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

VerifyRow(parser_mediator, row)[source]

Verifies if a line of the file is in the expected format.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

Returns

True if this is the correct parser, False otherwise.

Return type

bool

plaso.parsers.ntfs module

Parser for NTFS metadata files.

class plaso.parsers.ntfs.NTFSFileStatEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

NTFS file system stat event data.

access_time

file entry last access date and time.

Type

dfdatetime.DateTimeValues

attribute_type

attribute type for example “0x00000030”, which represents “$FILE_NAME”.

Type

int

creation_time

file entry creation date and time.

Type

dfdatetime.DateTimeValues

display_name

display name.

Type

str

entry_modification_time

file entry modification date and time.

Type

dfdatetime.DateTimeValues

file_attribute_flags

NTFS file attribute flags.

Type

int

file_reference

NTFS file reference.

Type

int

file_system_type

file system type.

Type

str

filename

name of the file.

Type

str

is_allocated

True if the MFT entry is allocated (marked as in use).

Type

bool

modification_time

file entry last modification date and time.

Type

dfdatetime.DateTimeValues

name

name associated with the stat event, for example that of a $FILE_NAME attribute or None if not available.

Type

str

parent_file_reference

NTFS file reference of the parent.

Type

int

path_hints

hints about the full path of the file.

Type

list[str]

path of the symbolic link target.

Type

str

DATA_TYPE = 'fs:stat:ntfs'
class plaso.parsers.ntfs.NTFSMFTParser[source]

Bases: FileObjectParser

Parses a NTFS $MFT metadata file.

DATA_FORMAT = 'NTFS $MFT metadata file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'mft'
ParseFileObject(parser_mediator, file_object)[source]

Parses a NTFS $MFT metadata file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

class plaso.parsers.ntfs.NTFSUSNChangeEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

NTFS USN change event data.

file_attribute_flags

NTFS file attribute flags.

Type

int

filename

name of the file associated with the event.

Type

str

file_reference

NTFS file reference.

Type

int

file_system_type

file system type.

Type

str

parent_file_reference

NTFS file reference of the parent.

Type

int

offset

offset of the USN record relative to the start of the $J data stream, from which the event data was extracted.

Type

int

update_reason_flags

update reason flags.

Type

int

update_sequence_number

update sequence number.

Type

int

update_source_flags

update source flags.

Type

int

update_time

update date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'fs:ntfs:usn_change'
class plaso.parsers.ntfs.NTFSUsnJrnlParser[source]

Bases: FileObjectParser, DtFabricHelper

Parses a NTFS USN change journal.

DATA_FORMAT = 'NTFS USN change journal ($UsnJrnl:$J) file system metadata file'
NAME = 'usnjrnl'
ParseFileObject(parser_mediator, file_object)[source]

Parses a NTFS $UsnJrnl metadata file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

plaso.parsers.olecf module

Parser for OLE Compound Files (OLECF).

class plaso.parsers.olecf.OLECFParser[source]

Bases: FileObjectParser

Parses OLE Compound Files (OLECF).

DATA_FORMAT = 'OLE Compound File (OLECF) format'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'olecf'
ParseFileObject(parser_mediator, file_object)[source]

Parses an OLE Compound File (OLECF) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

plaso.parsers.opera module

Parsers for Opera Browser history files.

class plaso.parsers.opera.OperaGlobalHistoryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Opera global history entry data.

description

description.

Type

str

last_visited_time

date and time the URL was last visited.

Type

dfdatetime.DateTimeValues

popularity_index

popularity index.

Type

int

title

title.

Type

str

url

URL.

Type

str

DATA_TYPE = 'opera:history:entry'
class plaso.parsers.opera.OperaGlobalHistoryParser[source]

Bases: FileObjectParser

Parses the Opera global_history.dat file.

DATA_FORMAT = 'Opera global history (global_history.dat) file'
NAME = 'opera_global'
ParseFileObject(parser_mediator, file_object)[source]

Parses an Opera global history file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.opera.OperaTypedHistoryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Opera typed history entry data.

entry_selection

information about whether the URL was directly typed in or the result of the user choosing from the auto complete.

Type

str

entry_type

information about whether the URL was directly typed in or the result of the user choosing from the auto complete.

Type

str

last_typed_time

date and time the URL was last typed.

Type

dfdatetime.DateTimeValues

url

typed URL or hostname.

Type

str

DATA_TYPE = 'opera:history:typed_entry'
class plaso.parsers.opera.OperaTypedHistoryParser[source]

Bases: FileObjectParser

Parses the Opera typed_history.xml file.

DATA_FORMAT = 'Opera typed history (typed_history.xml) file'
NAME = 'opera_typed_history'
ParseFileObject(parser_mediator, file_object)[source]

Parses an Opera typed history file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.pe module

A parser for Portable Executable (PE) files.

Also see:

https://www.mandiant.com/resources/blog/tracking-malware-import-hashing

class plaso.parsers.pe.PEDLLImportEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Portable Executable (PE) DLL import event data.

delayed_import

True if the DLL is imported at run-time.

Type

bool

modification_time

last modification date and time.

Type

dfdatetime.DateTimeValues

name

name of the imported DLL.

Type

str

DATA_TYPE = 'pe_coff:dll_import'
class plaso.parsers.pe.PEFileEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Portable Executable (PE) file event data.

creation_time

creation date and time.

Type

dfdatetime.DateTimeValues

export_dll_name

name of the exported DLL.

Type

str

export_table_modification_time

export table last modification date and time.

Type

dfdatetime.DateTimeValues

imphash

“Import Hash” of the Portable Executable (PE) file.

Type

str

load_configuration_table_modification_time

load configuration table last modification date and time.

Type

dfdatetime.DateTimeValues

pe_type

type of Portable Executable (PE) file.

Type

str

section_names

names of the sections in the Portable Executable (PE) file.

Type

list[str]

DATA_TYPE = 'pe_coff:file'
class plaso.parsers.pe.PEParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Portable Executable (PE) files.

DATA_FORMAT = 'Portable Executable (PE) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

NAME = 'pe'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Portable Executable (PE) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.pe.PEResourceEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Portable Executable (PE) resource event data.

identifier

identifier of the resource.

Type

int

modification_time

last modification date and time.

Type

dfdatetime.DateTimeValues

name

name of the resource.

Type

str

DATA_TYPE = 'pe_coff:resource'

plaso.parsers.plist module

Parser for binary and text Property List (plist) files.

class plaso.parsers.plist.PlistParser[source]

Bases: FileObjectParser

Parser for binary and text Property List (plist) files.

DATA_FORMAT = 'Property list (plist) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

a format specification or None if not available.

Return type

FormatSpecification

NAME = 'plist'
ParseFileObject(parser_mediator, file_object)[source]

Parses a plist file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.pls_recall module

Parser for PL/SQL Developer Recall files.

class plaso.parsers.pls_recall.PlsRecallEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

PL/SQL Recall event data.

database_name

name of the database.

Type

str

offset

offset of the PL/SQL Recall record relative to the start of the file, from which the event data was extracted.

Type

int

query

PL/SQL query.

Type

str

sequence_number

sequence number.

Type

int

username

username used to query.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'pls_recall:entry'
class plaso.parsers.pls_recall.PlsRecallParser[source]

Bases: FileObjectParser, DtFabricHelper

Parse PL/SQL Recall files.

This parser is based on the Delphi definition of the data type:

TRecallRecord = packed record

Sequence: Integer; TimeStamp: TDateTime; Username: array[0..30] of Char; Database: array[0..80] of Char; Text: array[0..4000] of Char;

end;

Delphi TDateTime is a little-endian 64-bit floating-point value without time zone information.

DATA_FORMAT = 'PL SQL cache file (PL-SQL developer recall file) format'
NAME = 'pls_recall'
ParseFileObject(parser_mediator, file_object)[source]

Parses a PLSRecall.dat file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.plugins module

This file contains basic interface for plugins within Plaso.

This library serves a basis for all plugins in Plaso, whether that are Windows Registry plugins, SQLite plugins or any other parsing plugins.

This is provided as a separate file to make it easier to inherit in other projects that may want to use the Plaso plugin system.

class plaso.parsers.plugins.BasePlugin[source]

Bases: object

A plugin is a lightweight parser that makes use of a common data structure.

When a data structure is common among several artifacts or files a plugin infrastructure can be written to make writing parsers simpler. The goal of a parser plugin is to have only a single parser that understands the data structure that can call plugins that have specialized knowledge of certain structures.

An example of this is a SQLite database. A plugin can be written that has knowledge of certain database, such as Chrome history, or Skype history, etc. This can be done without needing to write a fully-fledged parser that needs to re-implement the data structure knowledge. A single parser can be created that calls the plugins to see if it knows that particular database.

Another example is Windows Registry, there a single parser that can parse the Registry can be made and the job of a single plugin is to parse a particular Registry key. The parser can then read a Registry key and compare it to a list of available plugins to see if it can be parsed.

DATA_FORMAT = ''
NAME = 'base_plugin'
Process(parser_mediator, **kwargs)[source]

Extracts events using a parser plugin.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • kwargs (dict[str, object]) – Depending on the plugin they may require different sets of arguments to be able to evaluate whether or not this is the correct plugin.

Raises

ValueError – when there are unused keyword arguments.

UpdateChainAndProcess(parser_mediator, **kwargs)[source]

Extracts events using a parser plugin and synchronizes the parser chain.

This method updates the parser chain object held by the mediator, transfers control to the plugin-specific Process() method, and updates the chain again once the processing is complete.

Parameters

parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

class plaso.parsers.plugins.BasePluginCache[source]

Bases: object

A generic cache for parser plugins.

GetResults(attribute, default_value=None)[source]

Retrieves a cached attribute.

Parameters
  • attribute (str) – name of the cached attribute.

  • default_value (Optional[object]) – default value.

Returns

value of the cached attribute or default value if the cache

does not contain the attribute.

Return type

object

plaso.parsers.presets module

The parser and parser plugin presets.

class plaso.parsers.presets.ParserPreset(name, parsers)[source]

Bases: object

Parser and parser plugin preset.

deprecated

True if the preset is deprecated.

Type

bool

name

name of the preset.

Type

str

operating_systems

operating system artifact attribute containers, that specify to which operating systems the preset applies.

Type

list[OperatingSystemArtifact]

parsers

names of parser and parser plugins.

Type

list[str]

class plaso.parsers.presets.ParserPresetsManager[source]

Bases: object

The parsers and plugin presets manager.

GetNames()[source]

Retrieves the preset names.

Returns

preset names in alphabetical order.

Return type

list[str]

GetParsersByPreset(preset_name)[source]

Retrieves the parser and plugin names of a specific preset.

Parameters

preset_name (str) – name of the preset.

Returns

parser and plugin names in alphabetical order.

Return type

list[str]

Raises

KeyError – if the preset does not exist.

GetPresetByName(name)[source]

Retrieves a specific preset definition by name.

Parameters

name (str) – name of the preset.

Returns

a parser preset or None if not available.

Return type

ParserPreset

GetPresetsByOperatingSystem(operating_system)[source]

Retrieves preset definitions for a specific operating system.

Parameters

operating_system (OperatingSystemArtifact) – an operating system artifact attribute container.

Returns

preset definition that correspond with the

operating system.

Return type

list[PresetDefinition]

GetPresetsInformation()[source]

Retrieves the presets information.

Returns

containing:

str: preset name. str: comma separated parser and plugin names that are defined by

the preset.

Return type

list[tuple]

ReadFromFile(path)[source]

Reads parser and parser plugin presets from a file.

Parameters

path (str) – path of file that contains the the parser and parser plugin presets configuration.

Raises

MalformedPresetError – if one or more plugin preset definitions are malformed.

plaso.parsers.recycler module

Parser for Windows Recycle files, INFO2 and $I/$R pairs.

class plaso.parsers.recycler.WinRecycleBinEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Recycle Bin event data.

deletion_time

file entry deletion date and time.

Type

dfdatetime.DateTimeValues

drive_number

drive number.

Type

int

file_size

file size.

Type

int

offset

offset of the Recycle Bin record relative to the start of the file, from which the event data was extracted.

Type

int

original_filename

filename.

Type

str

record_index

index of the record, from which the event data was extracted.

Type

int

short_filename

short filename.

Type

str

DATA_TYPE = 'windows:metadata:deleted_item'
class plaso.parsers.recycler.WinRecycleBinParser[source]

Bases: FileObjectParser, DtFabricHelper

Parses the Windows $Recycle.Bin $I files.

DATA_FORMAT = 'Windows $Recycle.Bin $I file'
NAME = 'recycle_bin'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Recycle.Bin metadata ($I) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.recycler.WinRecyclerInfo2Parser[source]

Bases: FileObjectParser, DtFabricHelper

Parses the Windows Recycler INFO2 file.

DATA_FORMAT = 'Windows Recycler INFO2 file'
NAME = 'recycle_bin_info2'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Recycler INFO2 file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.safari_cookies module

Parser for Safari Binary Cookie files.

class plaso.parsers.safari_cookies.BinaryCookieParser[source]

Bases: FileObjectParser, CookiePluginsHelper, DtFabricHelper

Parser for Safari Binary Cookie files.

DATA_FORMAT = 'Safari Binary Cookie file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification for parser selection.

Returns

format specification.

Return type

FormatSpecification

NAME = 'binary_cookies'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Safari binary cookie file-like object.

Parameters
  • parser_mediator (ParserMediator) – parser mediator.

  • file_object (dfvfs.FileIO) – file-like object to be parsed.

Raises
  • ParseError – when the page sizes array cannot be parsed.

  • WrongParser – when the file cannot be parsed, this will signal the event extractor to apply other parsers.

class plaso.parsers.safari_cookies.SafariBinaryCookieEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Safari binary cookie event data.

cookie_name

cookie name.

Type

str

cookie_value

cookie value.

Type

str

creation_time

date and time the cookie was created.

Type

dfdatetime.DateTimeValues

expiration_time

date and time the cookie expires.

Type

dfdatetime.DateTimeValues

flags

cookie flags.

Type

int

path

path of the cookie.

Type

str

url

URL where this cookie is valid.

Type

str

DATA_TYPE = 'safari:cookie:entry'

plaso.parsers.spotlight_storedb module

Parser for Apple Spotlight store database files.

class plaso.parsers.spotlight_storedb.SpotlightStoreDatabaseParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Apple Spotlight store database (store.db) files.

DATA_FORMAT = 'Apple Spotlight store database (store.db) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'spotlight_storedb'
ParseFileObject(parser_mediator, file_object)[source]

Parses an Apple Spotlight store database file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataAttribute[source]

Bases: object

Metadata attribute.

key

key or name of the metadata attribute.

Type

str

property_type

metadata attribute property type.

Type

int

value

metadata attribute value.

Type

object

value_type

metadata attribute value type.

Type

int

class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataItem[source]

Bases: object

Metadata item.

attributes

metadata attributes.

Type

dict[str, SpotlightStoreMetadataAttribute]

data_size

size of the record data.

Type

int

flags

record flags.

Type

int

identifier

file (system) entry identifier.

Type

int

item_identifier

item identifier.

Type

int

last_update_time

last update time.

Type

int

parent_identifier

parent file (system) entry identifier.

Type

int

class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataItemEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Apple Spotlight store database metadata item event data.

added_time

date and time the item was added (kMDItemDateAdded).

Type

dfdatetime.DateTimeValues

attribute_change_time

date and time an attribute was last changed (kMDItemAttributeChangeDate).

Type

dfdatetime.DateTimeValues

content_creation_time

date and time the content was created (kMDItemContentCreationDate).

Type

dfdatetime.DateTimeValues

content_modification_time

date and time the content was last modified (kMDItemContentModificationDate).

Type

dfdatetime.DateTimeValues

content_type

content type of the corresponding file (system) entry (kMDItemContentType).

Type

str

creation_time

date and time the item was created (_kMDItemCreationDate).

Type

dfdatetime.DateTimeValues

downloaded_time

date and time the item was downloaded (kMDItemDownloadedDate).

Type

dfdatetime.DateTimeValues

file_name

name of the corresponding file (system) entry (_kMDItemFileName).

Type

str

file_system_identifier

file system identifier, for example the catalog node identifier (CNID) on HFS.

Type

int

kind

item kind (kMDItemKind).

Type

str

modification_time

date and time the item was last modified (_kMDItemContentChangeDate).

Type

dfdatetime.DateTimeValues

parent_file_system_identifier

file system identifier of the parent.

Type

int

purchase_time

date and time the item was purchased in the AppStore (kMDItemAppStorePurchaseDate).

Type

dfdatetime.DateTimeValues

snapshot_times

dates and times of the creation of backup snaphots (_kTimeMachineOldestSnapshot and _kTimeMachineNewestSnapshot).

Type

list[dfdatetime.DateTimeValues]

update_time

date and time the item was last updated.

Type

dfdatetime.DateTimeValues

used_times

dates and times when the item was used (kMDItemUsedDates and kMDItemLastUsedDate).

Type

list[dfdatetime.DateTimeValues]

DATA_TYPE = 'spotlight:metadata_item'

plaso.parsers.sqlite module

SQLite parser.

class plaso.parsers.sqlite.SQLiteCache[source]

Bases: BasePluginCache

Cache for storing results of SQL queries.

CacheQueryResults(sql_results, attribute_name, key_name, column_names)[source]

Build a dictionary object based on a SQL command.

This function will take a SQL command, execute it and for each resulting row it will store a key in a dictionary.

An example:

sql_results = A SQL result object after executing the
              SQL command: 'SELECT foo, bla, bar FROM my_table'
attribute_name = 'all_the_things'
key_name = 'foo'
column_names = ['bla', 'bar']

Results from running this against the database: ‘first’, ‘stuff’, ‘things’ ‘second’, ‘another stuff’, ‘another thing’

This will result in a dictionary object being created in the cache, called ‘all_the_things’ and it will contain the following value:

all_the_things = {
    'first': ['stuff', 'things'],
    'second': ['another_stuff', 'another_thing'],
    'third': ['single_thing']}
Parameters
  • sql_results (sqlite3.Cursor) – result after executing a SQL command on a database.

  • attribute_name (str) – attribute name in the cache to store results to. This will be the name of the dictionary attribute.

  • key_name (str) – name of the result field that should be used as a key in the resulting dictionary that is created.

  • column_names (list[str]) – of column names that are stored as values to the dictionary. If this list has only one value in it the value will be stored directly, otherwise the value will be a list containing the extracted results based on the names provided in this list.

GetRowCache(query)[source]

Retrieves the row cache for a specific query.

The row cache is a set that contains hashes of values in a row. The row cache is used to find duplicate row when a database and a database with a WAL file is parsed.

Parameters

query (str) – query.

Returns

hashes of the rows that have been parsed.

Return type

set

class plaso.parsers.sqlite.SQLiteDatabase(filename, temporary_directory=None)[source]

Bases: object

SQLite database.

schema

schema as an SQL query per table name, for example {‘Users’: ‘CREATE TABLE Users (“id” INTEGER PRIMARY KEY, …)’}.

Type

dict[str, str]

Close()[source]

Closes the database connection and cleans up the temporary file.

Open(file_object, wal_file_object=None)[source]

Opens a SQLite database file.

Since pysqlite cannot read directly from a file-like object a temporary copy of the file is made. After creating a copy the database file this function sets up a connection with the database and determines the names of the tables.

Parameters
  • file_object (dfvfs.FileIO) – file-like object.

  • wal_file_object (Optional[dfvfs.FileIO]) – file-like object for the Write-Ahead Log (WAL) file.

Raises
  • IOError – if the file-like object cannot be read.

  • OSError – if the file-like object cannot be read.

  • sqlite3.DatabaseError – if the database cannot be parsed.

  • ValueError – if the file-like object is missing.

Query(query)[source]

Queries the database.

Parameters

query (str) – SQL query.

Returns

results.

Return type

sqlite3.Cursor

Raises

sqlite3.DatabaseError – if querying the database fails.

SCHEMA_QUERY = 'SELECT tbl_name, sql FROM sqlite_master WHERE type = "table" AND tbl_name != "xp_proc" AND tbl_name != "sqlite_sequence"'
property tables

names of all the tables.

Type

list[str]

class plaso.parsers.sqlite.SQLiteParser[source]

Bases: FileEntryParser

Parses SQLite database files.

DATA_FORMAT = 'SQLite database file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

a format specification or None if not available.

Return type

FormatSpecification

NAME = 'sqlite'
ParseFileEntry(parser_mediator, file_entry)[source]

Parses a SQLite database file entry.

Parameters
  • parser_mediator (ParserMediator) – parser mediator.

  • file_entry (dfvfs.FileEntry) – file entry to be parsed.

plaso.parsers.symantec module

Symantec AV Corporate Edition and Endpoint Protection log file parser.

class plaso.parsers.symantec.SymantecEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Symantec event data.

access

access.

Type

str

action0

action0.

Type

str

action1

action1.

Type

str

action1_status

action1 status.

Type

str

action2

action2.

Type

str

action2_status

action2 status.

Type

str

address

address.

Type

str

backup_id

backup identifier.

Type

str

cat

category.

Type

str

cleaninfo

clean information.

Type

str

clientgroup

client group.

Type

str

compressed

compressed.

Type

str

computer

computer.

Type

str

definfo

definfo.

Type

str

defseqnumber

def sequence number.

Type

str

deleteinfo

delete information.

Type

str

depth

depth.

Type

str

description

description.

Type

str

domain_guid

domain identifier (GUID).

Type

str

domainname

domain name.

Type

str

err_code

error code.

Type

str

event_data

event data.

Type

str

event

event.

Type

str

extra

extra.

Type

str

file

file.

Type

str

flags

flags.

Type

str

groupid

group identifier.

Type

str

guid

guid.

Type

str

last_written_time

entry last written date and time.

Type

dfdatetime.DateTimeValues

license_expiration_dt

license expiration date.

Type

str

license_feature_name

license feature name.

Type

str

license_feature_ver

license feature ver.

Type

str

license_fulfillment_id

license fulfillment identifier.

Type

str

license_lifecycle

license lifecycle.

Type

str

license_seats_delta

license seats delta.

Type

str

license_seats

license seats.

Type

str

license_seats_total

license seats total.

Type

str

license_serial_num

license serial number.

Type

str

license_start_dt

license start date.

Type

str

logger

logger.

Type

str

login_domain

login domain.

Type

str

log_session_guid

log session identifier (GUID).

Type

str

macaddr

MAC address.

Type

str

new_ext

new ext.

Type

str

ntdomain

ntdomain.

Type

str

offset

offset.

Type

str

parent

parent.

Type

str

quarfwd_status

quarfwd status.

Type

str

remote_machine_ip

remote machine IP address.

Type

str

remote_machine

remote machine.

Type

str

scanid

scan identifier.

Type

str

snd_status

snd status.

Type

str

status

status.

Type

str

still_infected

still infected.

Type

str

time

time.

Type

str

user

user.

Type

str

vbin_id

vbin identifier.

Type

str

vbin_session_id

vbin session identifier.

Type

str

version

version.

Type

str

virus_id

virus identifier.

Type

str

virus

virus.

Type

str

virustype

virustype.

Type

str

DATA_TYPE = 'av:symantec:scanlog'
class plaso.parsers.symantec.SymantecParser[source]

Bases: DSVParser

Parses Symantec AV Corporate Edition and Endpoint Protection log files.

COLUMNS = ['time', 'event', 'cat', 'logger', 'computer', 'user', 'virus', 'file', 'action1', 'action2', 'action0', 'virustype', 'flags', 'description', 'scanid', 'new_ext', 'groupid', 'event_data', 'vbin_id', 'virus_id', 'quarfwd_status', 'access', 'snd_status', 'compressed', 'depth', 'still_infected', 'definfo', 'defseqnumber', 'cleaninfo', 'deleteinfo', 'backup_id', 'parent', 'guid', 'clientgroup', 'address', 'domainname', 'ntdomain', 'macaddr', 'version:', 'remote_machine', 'remote_machine_ip', 'action1_status', 'action2_status', 'license_feature_name', 'license_feature_ver', 'license_serial_num', 'license_fulfillment_id', 'license_start_dt', 'license_expiration_dt', 'license_lifecycle', 'license_seats_total', 'license_seats', 'err_code', 'license_seats_delta', 'status', 'domain_guid', 'log_session_guid', 'vbin_session_id', 'login_domain', 'extra']
DATA_FORMAT = 'Symantec AV Corporate Edition and Endpoint Protection log file'
NAME = 'symantec_scanlog'
ParseRow(parser_mediator, row_offset, row)[source]

Parses a line of the log file and produces events.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row_offset (int) – line number of the row.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

VerifyRow(parser_mediator, row)[source]

Verifies if a line of the file is in the expected format.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

Returns

True if this is the correct parser, False otherwise.

Return type

bool

plaso.parsers.systemd_journal module

Parser for Systemd journal files.

class plaso.parsers.systemd_journal.SystemdJournalEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Systemd journal event data.

body

message body.

Type

str

hostname

hostname.

Type

str

pid

process identifier (PID).

Type

int

reporter

reporter.

Type

str

written_time

date and time the log entry was written.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'systemd:journal'
class plaso.parsers.systemd_journal.SystemdJournalParser[source]

Bases: FileObjectParser, DtFabricHelper

Parses Systemd Journal files.

DATA_FORMAT = 'Systemd journal file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'systemd_journal'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Systemd journal file-like object.

Parameters
  • parser_mediator (ParserMediator) – parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the header cannot be parsed.

plaso.parsers.text_parser module

Text log parser.

class plaso.parsers.text_parser.EncodedTextReader(file_object, encoding='utf-8', encoding_errors='strict')[source]

Bases: object

Encoded text reader.

lines

lines of text.

Type

str

BUFFER_SIZE = 65536
ReadLine()[source]

Reads a line.

Returns

line read from the lines buffer.

Return type

str

ReadLines()[source]

Reads lines into the lines buffer.

SkipAhead(number_of_characters)[source]

Skips ahead a number of characters.

Parameters

number_of_characters (int) – number of characters.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

class plaso.parsers.text_parser.TextLogParser[source]

Bases: FileObjectParser

Text-based log file parser.

DATA_FORMAT = 'text-based log file'
EnablePlugins(plugin_includes)[source]

Enables parser plugins.

Parameters

plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.

NAME = 'text'
ParseFileObject(parser_mediator, file_object)[source]

Parses a text log file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.trendmicroav module

Parser for Trend Micro Antivirus logs.

Trend Micro uses two log files to track the scans (both manual/scheduled and real-time) and the web reputation (network scan/filtering).

Currently only the first log is supported.

class plaso.parsers.trendmicroav.OfficeScanVirusDetectionParser[source]

Bases: TrendMicroBaseParser

Parses the Trend Micro Office Scan Virus Detection Log.

COLUMNS = ['date', 'time', 'threat', 'action', 'scan_type', 'unused1', 'path', 'filename', 'unused2', 'timestamp', 'unused3', 'unused4']
DATA_FORMAT = 'Trend Micro Office Scan Virus Detection log file'
NAME = 'trendmicro_vd'
ParseRow(parser_mediator, row_offset, row)[source]

Parses a line of the log file and produces events.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row_offset (int) – offset of the line from which the row was extracted.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

VerifyRow(parser_mediator, row)[source]

Verifies if a line of the file is in the expected format.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

Returns

True if this is the correct parser, False otherwise.

Return type

bool

class plaso.parsers.trendmicroav.OfficeScanWebReputationParser[source]

Bases: TrendMicroBaseParser

Parses the Trend Micro Office Scan Web Reputation detection log.

COLUMNS = ('date', 'time', 'block_mode', 'url', 'group_code', 'group_name', 'credibility_rating', 'policy_identifier', 'application_name', 'credibility_score', 'ip', 'threshold', 'timestamp', 'unused')
DATA_FORMAT = 'Trend Micro Office Web Reputation log file'
NAME = 'trendmicro_url'
ParseRow(parser_mediator, row_offset, row)[source]

Parses a line of the log file and produces events.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row_offset (int) – offset of the line from which the row was extracted.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

VerifyRow(parser_mediator, row)[source]

Verifies if a line of the file is in the expected format.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • row (dict[str, str]) – fields of a single row, as specified in COLUMNS.

Returns

True if this is the correct parser, False otherwise.

Return type

bool

class plaso.parsers.trendmicroav.TrendMicroAVEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Trend Micro AV Log event data.

action

action.

Type

str

filename

filename.

Type

str

offset

offset of the line relative to the start of the file, from which the event data was extracted.

Type

int

path

path.

Type

str

scan_type

scan_type.

Type

str

threat

threat.

Type

str

written_time

date and time the log entry was written.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'av:trendmicro:scan'
class plaso.parsers.trendmicroav.TrendMicroBaseParser[source]

Bases: DSVParser

Common code for parsing Trend Micro log files.

The file format is reminiscent of CSV, but is not quite the same; the delimiter is a three-character sequence and there is no provision for quoting or escaping.

COLUMNS = ()
DELIMITER = '<;>'
class plaso.parsers.trendmicroav.TrendMicroUrlEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Trend Micro Web Reputation Log event data.

application_name

application name.

Type

str

block_mode

operation mode.

Type

str

credibility_rating

credibility rating.

Type

int

credibility_score

credibility score.

Type

int

group_code

group code.

Type

str

group_name

group name.

Type

str

ip

IP address.

Type

str

offset

offset of the line relative to the start of the file, from which the event data was extracted.

Type

int

policy_identifier

policy identifier.

Type

int

threshold

threshold value.

Type

int

url

accessed URL.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'av:trendmicro:webrep'

plaso.parsers.utmp module

Parser for Linux utmp files.

class plaso.parsers.utmp.UtmpEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Linux libc6 utmp event data.

exit_status

exit status.

Type

int

hostname

hostname or IP address.

Type

str

ip_address

IP address from the connection.

Type

str

offset

offset of the utmp record relative to the start of the file, from which the event data was extracted.

Type

int

pid

process identifier (PID).

Type

int

terminal_identifier

inittab identifier.

Type

int

terminal

type of terminal.

Type

str

type

type of login.

Type

int

username

user name.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'linux:utmp:event'
class plaso.parsers.utmp.UtmpParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Linux libc6 utmp files.

DATA_FORMAT = 'Linux libc6 utmp file'
NAME = 'utmp'
ParseFileObject(parser_mediator, file_object)[source]

Parses an utmp file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.utmpx module

Parser for MacOS utmpx files.

class plaso.parsers.utmpx.UtmpxMacOSEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MacOS utmpx event data.

hostname

hostname or IP address.

Type

str

offset

offset of the utmpx record relative to the start of the file, from which the event data was extracted.

Type

int

pid

process identifier (PID).

Type

int

terminal

name of the terminal.

Type

str

terminal_identifier

inittab identifier.

Type

int

type

type of login.

Type

int

username

user name.

Type

str

written_time

entry written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'macos:utmpx:entry'
class plaso.parsers.utmpx.UtmpxParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Mac OS X 10.5 utmpx files.

DATA_FORMAT = 'Mac OS X 10.5 utmpx file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'utmpx'
ParseFileObject(parser_mediator, file_object)[source]

Parses an UTMPX file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

plaso.parsers.windefender_history module

Parser for Windows Defender scan DetectionHistory files.

class plaso.parsers.windefender_history.WinDefenderHistoryParser[source]

Bases: FileObjectParser, DtFabricHelper

Parses a Windows Defender scan DetectionHistory file.

DATA_FORMAT = 'Windows Defender scan DetectionHistory file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'windefender_history'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Defender History file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.windefender_history.WindowsDefenderHistoryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Defender scan DetectionHistory event data.

additional_filenames

locations of additional detected files.

Type

list[str]

container_filenames

location of files detected inside a container.

Type

list[str]

filename

name of the file that the threat was detected in.

Type

str

host_and_user

name of the host and user in “DOMAINUSER” format.

Type

str

process

name of the process that caused the detection.

Type

str

recorded_time

date and time the log entry was recorded.

Type

dfdatetime.DateTimeValues

sha256

SHA-256 hash of the file.

Type

str

threat_name

name of the threat that was detected.

Type

str

web_filenames

URI of files detected as downloaded from the web.

Type

list[str]

DATA_TYPE = 'av:defender:detection_history'

plaso.parsers.winevt module

Parser for Windows EventLog (EVT) files.

class plaso.parsers.winevt.WinEvtParser[source]

Bases: FileObjectParser

Parses Windows EventLog (EVT) files.

DATA_FORMAT = 'Windows EventLog (EVT) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'winevt'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows EventLog (EVT) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

class plaso.parsers.winevt.WinEvtRecordEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows EventLog (EVT) record event data.

creation_time

event record creation date and time.

Type

dfdatetime.DateTimeValues

computer_name

computer name stored in the event record.

Type

str

event_category

event category.

Type

int

event_identifier

event identifier.

Type

int

event_type

event type.

Type

int

facility

event facility.

Type

int

message_identifier

event message identifier.

Type

int

offset

offset of the event record relative to the start of the file, from which the event data was extracted.

Type

int

record_number

event record number.

Type

int

recovered

True if the record was recovered.

Type

bool

severity

event severity.

Type

int

source_name

name of the event source.

Type

str

strings

event strings.

Type

list[str]

user_sid

user security identifier (SID) stored in the event record.

Type

str

written_time

event record written date and time.

Type

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:evt:record'

plaso.parsers.winevtx module

Parser for Windows XML EventLog (EVTX) files.

class plaso.parsers.winevtx.WinEvtxParser[source]

Bases: FileObjectParser

Parses Windows XML EventLog (EVTX) files.

DATA_FORMAT = 'Windows XML EventLog (EVTX) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'winevtx'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows XML EventLog (EVTX) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

class plaso.parsers.winevtx.WinEvtxRecordEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows XML EventLog (EVTX) record event data.

creation_time

event record creation date and time.

Type

dfdatetime.DateTimeValues

computer_name

computer name stored in the event record.

Type

str

event_identifier

event identifier.

Type

int

event_level

event level.

Type

int

event_version

event version.

Type

int

message_identifier

event message identifier.

Type

int

offset

offset of the EVTX record relative to the start of the file, from which the event data was extracted.

Type

int

provider_identifier

identifier of the EventLog provider.

Type

str

record_number

event record number.

Type

int

recovered

True if the record was recovered.

Type

bool

source_name

name of the event source.

Type

str

strings

event strings.

Type

list[str]

user_sid

user security identifier (SID) stored in the event record.

Type

str

written_time

event record written date and time.

Type

dfdatetime.DateTimeValues

xml_string

XML representation of the event.

Type

str

DATA_TYPE = 'windows:evtx:record'

plaso.parsers.winjob module

Parser for Windows Scheduled Task job files.

class plaso.parsers.winjob.WinJobEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Scheduled Task event data.

application

path to job executable.

Type

str

comment

description of the scheduled task.

Type

str

last_run_time

executable (binary) last run date and time.

Type

dfdatetime.DateTimeValues

parameters

application command line parameters.

Type

str

username

username that scheduled the task.

Type

str

working_directory

working directory of the scheduled task.

Type

str

DATA_TYPE = 'windows:tasks:job'
class plaso.parsers.winjob.WinJobParser[source]

Bases: FileObjectParser, DtFabricHelper

Parse Windows Scheduled Task files for job events.

DATA_FORMAT = 'Windows Scheduled Task job (or at-job) file'
NAME = 'winjob'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows job file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises

WrongParser – when the file cannot be parsed.

class plaso.parsers.winjob.WinJobTriggerEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Scheduled Task trigger event data.

application

path to job executable.

Type

str

comment

description of the scheduled task.

Type

str

end_time

date and time the end of the trigger.

Type

dfdatetime.DateTimeValues

parameters

application command line parameters.

Type

str

start_time

date and time the start of the trigger.

Type

dfdatetime.DateTimeValues

trigger_type

trigger type.

Type

int

username

username that scheduled the task.

Type

str

working_directory

working directory of the scheduled task.

Type

str

DATA_TYPE = 'windows:tasks:trigger'

plaso.parsers.winlnk module

Parser for Windows Shortcut (LNK) files.

class plaso.parsers.winlnk.WinLnkLinkEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Shortcut (LNK) link event data.

access_time

file entry last access date and time.

Type

dfdatetime.DateTimeValues

birth_droid_file_identifier

distributed link tracking birth droid file identifier.

Type

str

birth_droid_volume_identifier

distributed link tracking birth droid volume identifier.

Type

str

command_line_arguments

command line arguments.

Type

str

creation_time

file entry creation date and time.

Type

dfdatetime.DateTimeValues

description

description of the linked item.

Type

str

drive_serial_number

drive serial number where the linked item resides.

Type

int

drive_type

drive type where the linked item resided.

Type

str

droid_file_identifier

distributed link tracking droid file identifier.

Type

str

droid_volume_identifier

distributed link tracking droid volume identifier.

Type

str

env_var_location

environment variables loction.

Type

str

file_attribute_flags

file attribute flags of the linked item.

Type

int

file_size

size of the linked item.

Type

int

icon_location

icon location.

Type

str

shell item list of the link target.

Type

str

local_path

local path of the linked item.

Type

str

modification_time

file entry last modification date and time.

Type

dfdatetime.DateTimeValues

network_path

local path of the linked item.

Type

str

relative_path

relative path.

Type

str

volume_label

volume label where the linked item resided.

Type

str

working_directory

working directory.

Type

str

DATA_TYPE = 'windows:lnk:link'
class plaso.parsers.winlnk.WinLnkParser[source]

Bases: FileObjectParser

Parses Windows Shortcut (LNK) files.

DATA_FORMAT = 'Windows Shortcut (LNK) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'lnk'
ParseFileLNKFile(parser_mediator, file_object, display_name)[source]

Parses a Windows Shortcut (LNK) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

  • display_name (str) – display name.

ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Shortcut (LNK) file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

plaso.parsers.winprefetch module

Parser for Windows Prefetch files.

class plaso.parsers.winprefetch.WinPrefetchExecutionEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Prefetch event data.

executable

executable filename.

Type

str

format_version

format version.

Type

int

last_run_time

executable (binary) last run date and time.

Type

dfdatetime.DateTimeValues

mapped_files

mapped filenames.

Type

list[str]

number_of_volumes

number of volumes.

Type

int

path_hints

possible full paths to the executable.

Type

list[str]

prefetch_hash

prefetch hash.

Type

int

previous_run_times

previous executable (binary) run date and time.

Type

list[dfdatetime.DateTimeValues]

run_count

run count.

Type

int

volume_device_paths

volume device paths.

Type

list[str]

volume_serial_numbers

volume serial numbers.

Type

list[int]

DATA_TYPE = 'windows:prefetch:execution'
class plaso.parsers.winprefetch.WinPrefetchParser[source]

Bases: FileObjectParser

A parser for Windows Prefetch files.

DATA_FORMAT = 'Windows Prefetch File (PF)'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns

format specification.

Return type

FormatSpecification

NAME = 'prefetch'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Prefetch file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

plaso.parsers.winreg_parser module

Parser for Windows NT Registry (REGF) files.

class plaso.parsers.winreg_parser.WinRegistryParser[source]

Bases: FileObjectParser

Parses Windows NT Registry (REGF) files.

DATA_FORMAT = 'Windows NT Registry (REGF) file'
EnablePlugins(plugin_includes)[source]

Enables parser plugins.

Parameters

plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.

classmethod GetFormatSpecification()[source]

Retrieves the format specification.

NAME = 'winreg'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Registry file-like object.

Parameters
  • parser_mediator (ParserMediator) – parser mediator.

  • file_object (dfvfs.FileIO) – a file-like object.

plaso.parsers.winrestore module

Parser for Windows Restore Point (rp.log) files.

class plaso.parsers.winrestore.RestorePointEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Restore Point event data.

creation_time

creation date and time.

Type

dfdatetime.DateTimeValues

description

description.

Type

str

restore_point_event_type

restore point event type.

Type

str

restore_point_type

restore point type.

Type

str

sequence_number

sequence number.

Type

str

DATA_TYPE = 'windows:restore_point:info'
class plaso.parsers.winrestore.RestorePointLogParser[source]

Bases: FileObjectParser, DtFabricHelper

A parser for Windows Restore Point (rp.log) files.

DATA_FORMAT = 'Windows Restore Point log (rp.log) file'
FILTERS = frozenset({<plaso.parsers.interface.FileNameFileEntryFilter object>})
NAME = 'rplog'
ParseFileObject(parser_mediator, file_object)[source]

Parses a Windows Restore Point (rp.log) log file-like object.

Parameters
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises

WrongParser – when the file cannot be parsed.

Module contents

This file imports Python modules that register parsers.