plaso.parsers package
Subpackages
- plaso.parsers.bencode_plugins package
- plaso.parsers.cookie_plugins package
- plaso.parsers.czip_plugins package
- plaso.parsers.esedb_plugins package
- plaso.parsers.jsonl_plugins package
- Submodules
- plaso.parsers.jsonl_plugins.aws_cloudtrail_log module
- plaso.parsers.jsonl_plugins.azure_activity_log module
- plaso.parsers.jsonl_plugins.azure_application_gateway_log module
- plaso.parsers.jsonl_plugins.docker_container_config module
- plaso.parsers.jsonl_plugins.docker_container_log module
- plaso.parsers.jsonl_plugins.docker_layer_config module
- plaso.parsers.jsonl_plugins.gcp_log module
- plaso.parsers.jsonl_plugins.interface module
- plaso.parsers.jsonl_plugins.ios_app_privacy module
- plaso.parsers.jsonl_plugins.microsoft365_audit_log module
- Module contents
- plaso.parsers.olecf_plugins package
- plaso.parsers.plist_plugins package
- Submodules
- plaso.parsers.plist_plugins.airport module
- plaso.parsers.plist_plugins.apple_account module
- plaso.parsers.plist_plugins.bluetooth module
- plaso.parsers.plist_plugins.default module
- plaso.parsers.plist_plugins.install_history module
- plaso.parsers.plist_plugins.interface module
- plaso.parsers.plist_plugins.ios_carplay module
- plaso.parsers.plist_plugins.ipod module
- plaso.parsers.plist_plugins.launchd module
- plaso.parsers.plist_plugins.macos_user module
- plaso.parsers.plist_plugins.safari_downloads module
- plaso.parsers.plist_plugins.safari_history module
- plaso.parsers.plist_plugins.software_update module
- plaso.parsers.plist_plugins.spotlight_searched_terms module
- plaso.parsers.plist_plugins.spotlight_volume module
- plaso.parsers.plist_plugins.time_machine module
- Module contents
- plaso.parsers.shared package
- plaso.parsers.sqlite_plugins package
- Submodules
- plaso.parsers.sqlite_plugins.android_calls module
- plaso.parsers.sqlite_plugins.android_hangouts module
- plaso.parsers.sqlite_plugins.android_sms module
- plaso.parsers.sqlite_plugins.android_tango module
- plaso.parsers.sqlite_plugins.android_twitter module
- plaso.parsers.sqlite_plugins.android_webview module
- plaso.parsers.sqlite_plugins.android_webviewcache module
- plaso.parsers.sqlite_plugins.chrome_autofill module
- plaso.parsers.sqlite_plugins.chrome_cookies module
- plaso.parsers.sqlite_plugins.chrome_extension_activity module
- plaso.parsers.sqlite_plugins.chrome_history module
- plaso.parsers.sqlite_plugins.dropbox module
- plaso.parsers.sqlite_plugins.firefox_cookies module
- plaso.parsers.sqlite_plugins.firefox_downloads module
- plaso.parsers.sqlite_plugins.firefox_history module
- plaso.parsers.sqlite_plugins.gdrive module
- plaso.parsers.sqlite_plugins.imessage module
- plaso.parsers.sqlite_plugins.interface module
- plaso.parsers.sqlite_plugins.ios_kik module
- plaso.parsers.sqlite_plugins.ios_netusage module
- plaso.parsers.sqlite_plugins.ios_powerlog module
- plaso.parsers.sqlite_plugins.ios_screentime module
- plaso.parsers.sqlite_plugins.ios_twitter module
- plaso.parsers.sqlite_plugins.kodi module
- plaso.parsers.sqlite_plugins.ls_quarantine module
- plaso.parsers.sqlite_plugins.mackeeper_cache module
- plaso.parsers.sqlite_plugins.macos_appusage module
- plaso.parsers.sqlite_plugins.macos_document_versions module
- plaso.parsers.sqlite_plugins.macos_knowledgec module
- plaso.parsers.sqlite_plugins.macos_notes module
- plaso.parsers.sqlite_plugins.macos_notification_center module
- plaso.parsers.sqlite_plugins.macos_tcc module
- plaso.parsers.sqlite_plugins.safari module
- plaso.parsers.sqlite_plugins.skype module
- plaso.parsers.sqlite_plugins.windows_eventtranscript module
- plaso.parsers.sqlite_plugins.windows_timeline module
- plaso.parsers.sqlite_plugins.zeitgeist module
- Module contents
- plaso.parsers.text_plugins package
- Submodules
- plaso.parsers.text_plugins.android_logcat module
- plaso.parsers.text_plugins.apache_access module
- plaso.parsers.text_plugins.apt_history module
- plaso.parsers.text_plugins.aws_elb_access module
- plaso.parsers.text_plugins.bash_history module
- plaso.parsers.text_plugins.confluence_access module
- plaso.parsers.text_plugins.dpkg module
- plaso.parsers.text_plugins.gdrive_synclog module
- plaso.parsers.text_plugins.google_logging module
- plaso.parsers.text_plugins.iis module
- plaso.parsers.text_plugins.interface module
- plaso.parsers.text_plugins.ios_lockdownd module
- plaso.parsers.text_plugins.ios_logd module
- plaso.parsers.text_plugins.ios_sysdiag_log module
- plaso.parsers.text_plugins.macos_appfirewall module
- plaso.parsers.text_plugins.macos_securityd module
- plaso.parsers.text_plugins.macos_wifi module
- plaso.parsers.text_plugins.popcontest module
- plaso.parsers.text_plugins.postgresql module
- plaso.parsers.text_plugins.santa module
- plaso.parsers.text_plugins.sccm module
- plaso.parsers.text_plugins.selinux module
- plaso.parsers.text_plugins.setupapi module
- plaso.parsers.text_plugins.skydrivelog module
- plaso.parsers.text_plugins.snort_fastlog module
- plaso.parsers.text_plugins.sophos_av module
- plaso.parsers.text_plugins.syslog module
- plaso.parsers.text_plugins.viminfo module
- plaso.parsers.text_plugins.vsftpd module
- plaso.parsers.text_plugins.winfirewall module
- plaso.parsers.text_plugins.xchatlog module
- plaso.parsers.text_plugins.xchatscrollback module
- plaso.parsers.text_plugins.zsh_extended_history module
- Module contents
- plaso.parsers.winreg_plugins package
- Submodules
- plaso.parsers.winreg_plugins.amcache module
- plaso.parsers.winreg_plugins.appcompatcache module
- plaso.parsers.winreg_plugins.bagmru module
- plaso.parsers.winreg_plugins.bam module
- plaso.parsers.winreg_plugins.ccleaner module
- plaso.parsers.winreg_plugins.default module
- plaso.parsers.winreg_plugins.interface module
- plaso.parsers.winreg_plugins.lfu module
- plaso.parsers.winreg_plugins.mountpoints module
- plaso.parsers.winreg_plugins.mrulist module
- plaso.parsers.winreg_plugins.mrulistex module
- plaso.parsers.winreg_plugins.msie_zones module
- plaso.parsers.winreg_plugins.network_drives module
- plaso.parsers.winreg_plugins.networks module
- plaso.parsers.winreg_plugins.officemru module
- plaso.parsers.winreg_plugins.outlook module
- plaso.parsers.winreg_plugins.programscache module
- plaso.parsers.winreg_plugins.run module
- plaso.parsers.winreg_plugins.sam_users module
- plaso.parsers.winreg_plugins.services module
- plaso.parsers.winreg_plugins.shutdown module
- plaso.parsers.winreg_plugins.task_scheduler module
- plaso.parsers.winreg_plugins.terminal_server module
- plaso.parsers.winreg_plugins.timezone module
- plaso.parsers.winreg_plugins.typedurls module
- plaso.parsers.winreg_plugins.usb module
- plaso.parsers.winreg_plugins.usbstor module
- plaso.parsers.winreg_plugins.userassist module
- plaso.parsers.winreg_plugins.windows_version module
- plaso.parsers.winreg_plugins.winlogon module
- plaso.parsers.winreg_plugins.winrar module
- Module contents
Submodules
plaso.parsers.android_app_usage module
Parser for the Android usage history (usage-history.xml) files.
- class plaso.parsers.android_app_usage.AndroidAppUsageEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Android application usage event data.
- component
name of the individual component of the application.
- Type
str
- last_resume_time
date and time the application was last resumed.
- Type
dfdatetime.DateTimeValues
- package
name of the Android application.
- Type
str
- DATA_TYPE = 'android:app_usage'
- class plaso.parsers.android_app_usage.AndroidAppUsageParser[source]
Bases:
FileObjectParser
Parses the Android usage history (usage-history.xml) file.
- DATA_FORMAT = 'Android usage history (usage-history.xml) file'
- NAME = 'android_app_usage'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Android usage-history file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.asl module
The Apple System Log (ASL) file parser.
- class plaso.parsers.asl.ASLEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple System Log (ASL) event data.
- computer_name
name of the host.
- Type
str
- extra_information
extra fields associated to the event.
- Type
str
- facility
facility.
- Type
str
- group_identifier
group identifier (GID).
- Type
int
- level
level of criticality of the event.
- Type
str
- message
message of the event.
- Type
str
- message_identifier
message identifier.
- Type
int
- process_identifier
process identifier (PID).
- Type
int
- read_group_identifier
the group identifier that can read this file, where -1 represents all.
- Type
int
- read_user_identifier
user identifier that can read this file, where -1 represents all.
- Type
int
- record_position
position of the event record.
- Type
int
- sender
sender or process that created the event.
- Type
str
- user_identifier
user identifier (UID).
- Type
int
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'macos:asl:entry'
- class plaso.parsers.asl.ASLFileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple System Log (ASL) file event data.
- creation_time
creation date and time.
- Type
dfdatetime.DateTimeValues
- format_version
ASL file format version.
- Type
int
- is_dirty
True if the last log entry offset does not match value in file header and the file is considered dirty.
- Type
bool
- DATA_TYPE = 'macos:asl:file'
- class plaso.parsers.asl.ASLParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Apple System Log (ASL) files.
- DATA_FORMAT = 'Apple System Log (ASL) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'asl_log'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an ASL file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.bencode_parser module
Parser for bencoded files.
- class plaso.parsers.bencode_parser.BencodeFile[source]
Bases:
object
Bencode file.
- GetValues()[source]
Retrieves the values in the root of the bencode file.
- Returns
values.
- Return type
- IsEmpty()[source]
Determines if the bencode file has no values (is empty).
- Returns
True if the bencode file is empty, False otherwise.
- Return type
bool
- Open(file_object)[source]
Opens a bencode file.
- Parameters
file_object (dfvfs.FileIO) – file-like object.
- Raises
IOError – if the file-like object cannot be read.
OSError – if the file-like object cannot be read.
ValueError – if the file-like object is missing.
- property keys
names of all the keys.
- Type
set[str]
- class plaso.parsers.bencode_parser.BencodeParser[source]
Bases:
FileObjectParser
Parser for bencoded files.
- DATA_FORMAT = 'Bencoded file'
- NAME = 'bencode'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a bencoded file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.bencode_parser.BencodeValues(decoded_values)[source]
Bases:
object
Bencode values.
- GetDateTimeValue(name)[source]
Retrieves a date and time value.
- Parameters
name (str) – name of the value.
- Returns
date and time or None if not available.
- Return type
dfdatetime.PosixTime
plaso.parsers.bodyfile module
Parser for the Sleuthkit (TSK) bodyfile format.
Sleuthkit version 3 format: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime 0|/lost+found|11|d/drwx——|0|0|12288|1337961350|1337961350|1337961350|0
- More information about the format specifications can be read here:
- class plaso.parsers.bodyfile.BodyfileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Bodyfile event data.
- access_time
file entry last access date and time.
- Type
dfdatetime.DateTimeValues
- change_time
file entry inode change (or metadata last modification) date and time.
- Type
dfdatetime.DateTimeValues
- creation_time
file entry creation date and time.
- Type
dfdatetime.DateTimeValues
- filename
name of the file.
- Type
str
- group_identifier
group identifier (GID), equivalent to st_gid.
- Type
int
- inode
“inode” of the file. Note that inode is an overloaded term in the context of a bodyfile and used for MFT entry index values as well.
- Type
int
- md5
MD5 hash of the file content, formatted as a hexadecimal string.
- Type
str
- mode_as_string
protection mode.
- Type
str
- modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- offset
number of the corresponding line, from which the event data was extracted.
- Type
int
- owner_identifier
user identifier (UID or SID) of the owner.
- Type
str
- size
size of the file content.
- Type
int
- symbolic_link_target
path of the symbolic link target.
- Type
str
- DATA_TYPE = 'fs:bodyfile:entry'
- class plaso.parsers.bodyfile.BodyfileParser[source]
Bases:
FileObjectParser
SleuthKit bodyfile parser.
- DATA_FORMAT = 'SleuthKit version 3 bodyfile'
- NAME = 'bodyfile'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a bodyfile file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.bsm module
Basic Security Module (BSM) event auditing file parser.
- class plaso.parsers.bsm.BSMEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Basic Security Module (BSM) audit event data.
- event_type
identifier that represents the type of the event.
- Type
int
- extra_tokens
event extra tokens, which is a list of dictionaries that contain: {token type: {token values}}
- Type
list[dict[str, dict[str, str]]]
- offset
offset of the BSM record relative to the start of the file, from which the event data was extracted.
- Type
int
- record_length
record length in bytes (trailer number).
- Type
int
- return_value
processed return value and exit status.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'bsm:entry'
- class plaso.parsers.bsm.BSMParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Basic Security Module (BSM) event auditing files.
- DATA_FORMAT = 'Basic Security Module (BSM) event auditing file'
- NAME = 'bsm_log'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a BSM file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.chrome_cache module
Parser for Google Chrome and Chromium Cache files.
- class plaso.parsers.chrome_cache.CacheAddress(cache_address)[source]
Bases:
object
Chrome cache address.
- block_number
block data file number.
- Type
int
- block_offset
offset within the block data file.
- Type
int
- block_size
block size.
- Type
int
- filename
name of the block data file.
- Type
str
- value
cache address.
- Type
int
- FILE_TYPE_BLOCK_1024 = 3
- FILE_TYPE_BLOCK_256 = 2
- FILE_TYPE_BLOCK_4096 = 4
- FILE_TYPE_BLOCK_RANKINGS = 1
- FILE_TYPE_SEPARATE = 0
- class plaso.parsers.chrome_cache.CacheEntry[source]
Bases:
object
Chrome cache entry.
- creation_time
creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.
- Type
int
- hash
super fast hash of the key.
- Type
int
- key
key.
- Type
bytes
- next
cache address of the next cache entry.
- Type
int
- original_url
original URL derived from the key.
- Type
str
- rankings_node
cache address of the rankings node.
- Type
int
- class plaso.parsers.chrome_cache.ChromeCacheDataBlockFileParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Chrome cache data block file parser.
- ParseCacheEntry(file_object, block_offset)[source]
Parses a cache entry.
- Parameters
file_object (dfvfs.FileIO) – a file-like object to read from.
block_offset (int) – block offset of the cache entry.
- Returns
cache entry.
- Return type
- Raises
ParseError – if the cache entry cannot be read.
- ParseFileObject(parser_mediator, file_object)[source]
Parses a file-like object.
- Parameters
parser_mediator (ParserMediator) – a parser mediator.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises
ParseError – when the file cannot be parsed.
- class plaso.parsers.chrome_cache.ChromeCacheEntryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome Cache event data.
- creation_time
creation date and time of the cache entry.
- Type
dfdatetime.DateTimeValues
- original_url
original URL.
- Type
str
- DATA_TYPE = 'chrome:cache:entry'
- class plaso.parsers.chrome_cache.ChromeCacheIndexFileParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Chrome cache index file parser.
- creation_time
creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.
- Type
int
- index_table
the cache addresses which are stored in the index file.
- Type
list[CacheAddress]
- ParseFileObject(parser_mediator, file_object)[source]
Parses a file-like object.
- Parameters
parser_mediator (ParserMediator) – a parser mediator.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises
ParseError – when the file cannot be parsed.
- class plaso.parsers.chrome_cache.ChromeCacheParser[source]
Bases:
FileEntryParser
Parses Chrome Cache files.
- DATA_FORMAT = 'Google Chrome or Chromium Cache file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'chrome_cache'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses Chrome Cache files.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – file entry.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.chrome_preferences module
A parser for the Chrome preferences file.
- class plaso.parsers.chrome_preferences.ChromeContentSettingsExceptionsEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome content settings exceptions event data.
- last_visited_time
date and time the URL was last visited.
- Type
dfdatetime.DateTimeValues
- permission
permission.
- Type
str
- primary_url
primary URL.
- Type
str
- secondary_url
secondary URL.
- Type
str
- DATA_TYPE = 'chrome:preferences:content_settings:exceptions'
- class plaso.parsers.chrome_preferences.ChromeExtensionInstallationEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome extension event data.
- extension_identifier
extension identifier.
- Type
str
- extension_name
extension name.
- Type
str
- installation_time
date and time the Chrome extension was installed.
- Type
dfdatetime.DateTimeValues
- path
path.
- Type
str
- DATA_TYPE = 'chrome:preferences:extension_installation'
- class plaso.parsers.chrome_preferences.ChromeExtensionsAutoupdaterEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome Extension Autoupdater event data.
- message
message.
- Type
str
- recorded_time
date and time the entry was recorded.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'chrome:preferences:extensions_autoupdater'
- class plaso.parsers.chrome_preferences.ChromePreferencesParser[source]
Bases:
FileObjectParser
Parses Chrome Preferences files.
- DATA_FORMAT = 'Google Chrome Preferences file'
- NAME = 'chrome_preferences'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Chrome preferences file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- REQUIRED_KEYS = frozenset({'browser', 'extensions'})
plaso.parsers.cups_ipp module
The CUPS IPP files parser.
CUPS IPP version 1.0: * https://datatracker.ietf.org/doc/html/rfc2565 * https://datatracker.ietf.org/doc/html/rfc2566 * https://datatracker.ietf.org/doc/html/rfc2567 * https://datatracker.ietf.org/doc/html/rfc2568 * https://datatracker.ietf.org/doc/html/rfc2569 * https://datatracker.ietf.org/doc/html/rfc2639
CUPS IPP version 1.1: * https://datatracker.ietf.org/doc/html/rfc2910 * https://datatracker.ietf.org/doc/html/rfc2911 * https://datatracker.ietf.org/doc/html/rfc3196 * https://datatracker.ietf.org/doc/html/rfc3510
CUPS IPP version 2.0: * N/A
- class plaso.parsers.cups_ipp.CupsIppEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
CUPS IPP event data.
- application
application that prints the document.
- Type
str
- computer_name
name of the computer.
- Type
str
- copies
number of copies.
- Type
int
- creation_time
date and time the print job was created (added).
- Type
dfdatetime.DateTimeValues
- doc_type
type of document.
- Type
str
- end_time
date and time the print job was stopped.
- Type
dfdatetime.DateTimeValues
- job_id
job identifier.
- Type
str
- job_name
job name.
- Type
str
- owner
real name of the user.
- Type
str
- printer_id
identification name of the print.
- Type
str
- start_time
date and time the print job was started.
- Type
dfdatetime.DateTimeValues
- uri
URL of the CUPS service.
- Type
str
- user
system user name.
- Type
str
- DATA_TYPE = 'cups:ipp:event'
- class plaso.parsers.cups_ipp.CupsIppParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for CUPS IPP files.
- DATA_FORMAT = 'CUPS IPP file'
- NAME = 'cups_ipp'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a CUPS IPP file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.custom_destinations module
Parser for custom destinations jump list (.customDestinations-ms) files.
- class plaso.parsers.custom_destinations.CustomDestinationsParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses custom destinations jump list (.customDestinations-ms) files.
- DATA_FORMAT = 'Custom destinations jump list (.customDestinations-ms) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'custom_destinations'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a .customDestinations-ms file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.czip module
This file contains a parser for compound ZIP files.
- class plaso.parsers.czip.CompoundZIPParser[source]
Bases:
FileObjectParser
Shared functionality for parsing compound ZIP files.
Compound ZIP files are ZIP files used as containers to create another file format, as opposed to archives of unrelated files.
- DATA_FORMAT = 'Compound ZIP file'
- NAME = 'czip'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a compound ZIP file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.dsv_parser module
Delimiter separated values (DSV) parser interface.
- class plaso.parsers.dsv_parser.DSVParser[source]
Bases:
FileObjectParser
Delimiter separated values (DSV) parser interface.
- COLUMNS = []
- DELIMITER = ','
- ESCAPE_CHARACTER = ''
- FIELD_SIZE_LIMIT = 131072
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NUMBER_OF_HEADER_LINES = 0
- ParseFileObject(parser_mediator, file_object)[source]
Parses a DSV text file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- abstract ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- QUOTE_CHAR = '"'
- abstract VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns
True if this is the correct parser, False otherwise.
- Return type
bool
plaso.parsers.esedb module
Parser for Extensible Storage Engine (ESE) database files (EDB).
- class plaso.parsers.esedb.ESEDBCache[source]
Bases:
BasePluginCache
A cache storing query results for ESEDB plugins.
- class plaso.parsers.esedb.ESEDBParser[source]
Bases:
FileObjectParser
Parses Extensible Storage Engine (ESE) database files (EDB).
- DATA_FORMAT = 'Extensible Storage Engine (ESE) Database File (EDB) format'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'esedb'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an ESE database file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- class plaso.parsers.esedb.ESEDatabase[source]
Bases:
object
Extensible Storage Engine (ESE) database.
- GetTableByName(name)[source]
Retrieves a table by its name.
- Parameters
name (str) – name of the table.
- Returns
- the table with the corresponding name or None if there is
no table with the name.
- Return type
pyesedb.table
- Open(file_object)[source]
Opens an Extensible Storage Engine (ESE) database file.
- Parameters
file_object (dfvfs.FileIO) – file-like object.
- Raises
IOError – if the file-like object cannot be read.
OSError – if the file-like object cannot be read.
ValueError – if the file-like object is missing.
- property tables
names of all the tables.
- Type
list[str]
plaso.parsers.filestat module
File system stat object parser.
- class plaso.parsers.filestat.FileStatEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
File system stat event data.
- access_time
file entry last access date and time.
- Type
dfdatetime.DateTimeValues
- added_time
file entry added date and time.
- Type
dfdatetime.DateTimeValues
- attribute_names
extended attribute names.
- Type
[str]
- backup_time
file entry backup date and time.
- Type
dfdatetime.DateTimeValues
- change_time
file entry inode change (or metadata last modification) date and time.
- Type
dfdatetime.DateTimeValues
- creation_time
file entry creation date and time.
- Type
dfdatetime.DateTimeValues
- deletion_time
file entry deletion date and time.
- Type
dfdatetime.DateTimeValues
- display_name
display name.
- Type
str
- file_entry_type
dfVFS file entry type.
- Type
int
- file_size
file size in bytes.
- Type
int
- file_system_type
file system type.
- Type
str
- filename
name of the file.
- Type
str
- group_identifier
group identifier (GID), equivalent to st_gid.
- Type
int
- inode
inode of the file.
- Type
int
- is_allocated
True if the file is allocated.
- Type
bool
- mode
access mode, equivalent to st_mode & 0x0fff.
- Type
int
- modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- number_of_links
number of hard links, equivalent to st_nlink.
- Type
int
- owner_identifier
user identifier (UID) of the owner, equivalent to st_uid.
- Type
int
- DATA_TYPE = 'fs:stat'
- class plaso.parsers.filestat.FileStatParser[source]
Bases:
FileEntryParser
Parses file system stat object.
- DATA_FORMAT = 'file system stat information'
- NAME = 'filestat'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses a file entry.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – a file entry.
plaso.parsers.firefox_cache module
Implements a parser for Firefox cache 1 and 2 files.
- class plaso.parsers.firefox_cache.BaseFirefoxCacheParser[source]
Bases:
FileObjectParser
Parses Firefox cache files.
- class plaso.parsers.firefox_cache.FirefoxCache2Parser[source]
Bases:
BaseFirefoxCacheParser
,DtFabricHelper
Parses Firefox cache version 2 files (Firefox 32 or later).
- DATA_FORMAT = 'Mozilla Firefox Cache version 2 file (version 32 or later)'
- NAME = 'firefox_cache2'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Firefox cache file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.firefox_cache.FirefoxCacheEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Firefox cache event data.
- data_size
size of the cached data.
- Type
int
- expiration_time
date and time the cache entry expires.
- Type
dfdatetime.DateTimeValues
- fetch_count
number of times the cache entry was fetched.
- Type
int
- frequency
???
- Type
int
- info_size
size of the metadata.
- Type
int
- last_fetched_time
date and time the cache entry was last fetched.
- Type
dfdatetime.DateTimeValues
- last_modified_time
date and time the cache entry was last modified.
- Type
dfdatetime.DateTimeValues
- location
???
- Type
str
- request_method
HTTP request method.
- Type
str
- request_size
HTTP request byte size.
- Type
int
- response_code
HTTP response code.
- Type
int
- url
URL of original content.
- Type
str
- version
cache format version.
- Type
str
- DATA_TYPE = 'firefox:cache:record'
- class plaso.parsers.firefox_cache.FirefoxCacheParser[source]
Bases:
BaseFirefoxCacheParser
,DtFabricHelper
Parses Firefox cache version 1 files (Firefox 31 or earlier).
- DATA_FORMAT = 'Mozilla Firefox Cache version 1 file (version 31 or earlier)'
- FIREFOX_CACHE_CONFIG
alias of
firefox_cache_config
- NAME = 'firefox_cache'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Firefox cache file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.fish_history module
Parser for fish history files.
- class plaso.parsers.fish_history.FishHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Fish history log event data.
- command
command that was executed.
- Type
str
- written_time
date and time the entry was written.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'fish:history:entry'
- class plaso.parsers.fish_history.FishHistoryParser[source]
Bases:
FileObjectParser
Parses events from Fish history files.
- DATA_FORMAT = 'Fish history file'
- NAME = 'fish_history'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a fish history file from a file-like object
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.fseventsd module
Parsers for MacOS fseventsd files.
- class plaso.parsers.fseventsd.FseventsdEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS file system event (fseventsd) event data
- event_identifier
the record event identifier.
- Type
int
- file_entry_modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- flags
flags stored in the record.
- Type
int
- node_identifier
file system node identifier related to the file system event.
- Type
int
- path
path recorded in the fseventsd record.
- Type
str
- DATA_TYPE = 'macos:fseventsd:record'
- class plaso.parsers.fseventsd.FseventsdParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for fseventsd files.
This parser supports both version 1 and version 2 fseventsd files.
- DATA_FORMAT = 'MacOS File System Events Disk Log Stream (fseventsd) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'fseventsd'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an fseventsd file.
- Parameters
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the header cannot be parsed.
plaso.parsers.interface module
The parsers and plugins interface classes.
- class plaso.parsers.interface.BaseFileEntryFilter[source]
Bases:
object
File entry filter interface.
- class plaso.parsers.interface.BaseParser[source]
Bases:
object
The parser interface.
- ALL_PLUGINS = {'*'}
- DATA_FORMAT = ''
- classmethod DeregisterPlugin(plugin_class)[source]
Deregisters a plugin class.
The plugin classes are identified based on their lower case name.
- Parameters
plugin_class (type) – class of the plugin.
- Raises
KeyError – if plugin class is not set for the corresponding name.
- EnablePlugins(plugin_includes)[source]
Enables parser plugins.
- Parameters
plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.
- FILTERS = frozenset({})
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
a format specification or None if not available.
- Return type
- classmethod GetPluginNames()[source]
Retrieves the names of registered plugins.
- Returns
names of the plugins.
- Return type
list[str]
- classmethod GetPluginObjectByName(plugin_name)[source]
Retrieves a specific plugin object by its name.
- Parameters
plugin_name (str) – name of the plugin.
- Returns
a plugin object or None if not available.
- Return type
- classmethod GetPlugins()[source]
Retrieves the registered plugins.
- Yields
tuple[str, type] – name and class of the plugin.
- NAME = 'base_parser'
- classmethod RegisterPlugin(plugin_class)[source]
Registers a plugin class.
The plugin classes are identified based on their lower case name.
- Parameters
plugin_class (type) – class of the plugin.
- Raises
KeyError – if plugin class is already set for the corresponding name.
- class plaso.parsers.interface.FileEntryParser[source]
Bases:
BaseParser
The file entry parser interface.
- Parse(parser_mediator)[source]
Parses the file entry and extracts event objects.
- Parameters
parser_mediator (ParserMediator) – a parser mediator.
- Raises
WrongParser – when the file cannot be parsed.
- abstract ParseFileEntry(parser_mediator, file_entry)[source]
Parses a file entry.
- Parameters
parser_mediator (ParserMediator) – a parser mediator.
file_entry (dfvfs.FileEntry) – a file entry to parse.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.interface.FileNameFileEntryFilter(filename)[source]
Bases:
BaseFileEntryFilter
File name file entry filter.
- class plaso.parsers.interface.FileObjectParser[source]
Bases:
BaseParser
The file-like object parser interface.
- Parse(parser_mediator, file_object)[source]
Parses a single file-like object.
- Parameters
parser_mediator (ParserMediator) – a parser mediator.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises
WrongParser – when the file cannot be parsed.
- abstract ParseFileObject(parser_mediator, file_object)[source]
Parses a file-like object.
- Parameters
parser_mediator (ParserMediator) – a parser mediator.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.java_idx module
Parser for Java Cache IDX files.
- class plaso.parsers.java_idx.JavaIDXEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Java IDX cache file event data.
- downloaded_time
date and time the content was downloaded.
- Type
dfdatetime.DateTimeValues
- expiration_time
date and time the cached download expires.
- Type
dfdatetime.DateTimeValues
- idx_version
format version of IDX file.
- Type
str
- ip_address
IP address of the host in the URL.
- Type
str
- modification_time
date and time the cached download expires.
- Type
dfdatetime.DateTimeValues
- url
URL of the downloaded file.
- Type
str
- DATA_TYPE = 'java:download:idx'
- class plaso.parsers.java_idx.JavaIDXParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Java WebStart Cache IDX files.
There are five structures defined. 6.02 files had one generic section that retained all data. From 6.03, the file went to a multi-section format where later sections were optional and had variable-lengths. 6.03, 6.04, and 6.05 files all have their main data section (#2) begin at offset 128. The short structure is because 6.05 files deviate after the 8th byte. So, grab the first 8 bytes to ensure it’s valid, get the file version, then continue on with the correct structures.
- DATA_FORMAT = 'Java WebStart Cache IDX file'
- NAME = 'java_idx'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Java WebStart Cache IDX file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.jsonl_parser module
Base parser for line-based JSON (JSON-L) log formats.
- class plaso.parsers.jsonl_parser.JSONLParser[source]
Bases:
FileObjectParser
Base parser for line-based JSON (JSON-L) log formats.
- DATA_FORMAT = 'JSON-L log file'
- NAME = 'jsonl'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a line-based JSON (JSON-L) log file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.locate module
Parser for locate database (updatedb) files.
- class plaso.parsers.locate.LocateDatabaseEvent(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Linux locate database (updatedb) event data.
- entries
contents of the locate database (updatedb) entry.
- Type
list[str]
- path
path of the locate database (updatedb) entry.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'linux:locate_database:entry'
- class plaso.parsers.locate.LocateDatabaseParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for locate database (updatedb) files.
- DATA_FORMAT = 'Locate database file (updatedb)'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'locate_database'
- ParseFileObject(parser_mediator, file_object, **kwargs)[source]
Parses a locate database (updatedb) file-like object.
- Parameters
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – file-like object to be parsed.
- Raises
WrongParser – when the file cannot be parsed, this will signal the event extractor to apply other parsers.
plaso.parsers.logger module
The parsers sub module logger.
plaso.parsers.macos_keychain module
Parser for MacOS keychain database files.
- class plaso.parsers.macos_keychain.KeychainApplicationRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS keychain application password record event data.
- account_name
name of the account.
- Type
str
- comments
comments added by the user.
- Type
str
- creation_time
creation date and time of the keychain record.
- Type
dfdatetime.DateTimeValues
- entry_name
name of the entry.
- Type
str
- modification_time
modification date and time of the keychain record.
- Type
dfdatetime.DateTimeValues
- ssgp_hash
password/certificate hash formatted as a hexadecimal string.
- Type
str
- text_description
description.
- Type
str
- DATA_TYPE = 'macos:keychain:application'
- class plaso.parsers.macos_keychain.KeychainDatabaseColumn[source]
Bases:
object
MacOS keychain database column.
- attribute_data_type
attribute (data) type.
- Type
int
- attribute_identifier
attribute identifier.
- Type
int
- attribute_name
attribute name.
- Type
str
- class plaso.parsers.macos_keychain.KeychainDatabaseTable[source]
Bases:
object
MacOS keychain database table.
- columns
columns.
- Type
list[KeychainDatabaseColumn]
- records
records.
- Type
list[dict[str, str]]
- relation_identifier
relation identifier.
- Type
int
- relation_name
relation name.
- Type
str
- class plaso.parsers.macos_keychain.KeychainInternetRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS keychain internet record event data.
- account_name
name of the account.
- Type
str
- comments
comments added by the user.
- Type
str
- creation_time
creation date and time of the keychain record.
- Type
dfdatetime.DateTimeValues
- entry_name
name of the entry.
- Type
str
- modification_time
modification date and time of the keychain record.
- Type
dfdatetime.DateTimeValues
- protocol
internet protocol used, for example “https”.
- Type
str
- ssgp_hash
password/certificate hash formatted as a hexadecimal string.
- Type
str
- text_description
description.
- Type
str
- type_protocol
sub-protocol used, for example “form”.
- Type
str
- where
domain name or IP where the password is used.
- Type
str
- DATA_TYPE = 'macos:keychain:internet'
- class plaso.parsers.macos_keychain.KeychainParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for MacOS keychain database files.
- DATA_FORMAT = 'MacOS keychain database file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'mac_keychain'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a MacOS keychain file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.manager module
The parsers and plugins manager.
- class plaso.parsers.manager.ParsersManager[source]
Bases:
object
The parsers and plugins manager.
- ALL_PLUGINS = {'*'}
- classmethod CheckFilterExpression(parser_filter_expression)[source]
Checks parser and plugin names in a parser filter expression.
- Parameters
parser_filter_expression (str) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns
containing:
- set(str): parser filter expression elements that contain known parser
and/or plugin names.
- set(str): parser filter expression elements that contain unknown parser
and/or plugin names.
- Return type
tuple
- classmethod CreateSignatureScanner(specification_store)[source]
Creates a signature scanner for format specifications with signatures.
- Parameters
specification_store (FormatSpecificationStore) – format specifications with signatures.
- Returns
signature scanner.
- Return type
pysigscan.scanner
- classmethod DeregisterParser(parser_class)[source]
Deregisters a parser class.
The parser classes are identified based on their lower case name.
- Parameters
parser_class (type) – parser class (subclass of BaseParser).
- Raises
KeyError – if parser class is not set for the corresponding name.
- classmethod GetFormatsWithSignatures(parser_filter_expression=None)[source]
Retrieves the format specifications that have signatures.
This method will create a specification store for parsers that define a format specification with signatures and a list of parser names for those that do not.
- Parameters
parser_filter_expression (Optional[str]) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns
containing:
FormatSpecificationStore: format specifications with signatures.
- list[str]: names of parsers that do not have format specifications with
signatures, or have signatures but also need to be applied ‘brute force’.
- Return type
tuple
- classmethod GetNamesOfParsersWithPlugins()[source]
Retrieves the names of all parsers with plugins.
- Returns
names of all parsers with plugins.
- Return type
list[str]
- classmethod GetParserObjects(parser_filter_expression=None)[source]
Retrieves the parser objects.
- Parameters
parser_filter_expression (Optional[str]) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns
parsers per name.
- Return type
dict[str, BaseParser]
- classmethod GetParserPluginsInformation(parser_filter_expression=None)[source]
Retrieves the parser plugins information.
- Parameters
parser_filter_expression (Optional[str]) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns
pairs of parser plugin names and descriptions.
- Return type
list[tuple[str, str]]
- classmethod GetParsersInformation()[source]
Retrieves the parsers information.
- Returns
parser names and descriptions.
- Return type
list[tuple[str, str]]
- classmethod RegisterParser(parser_class)[source]
Registers a parser class.
The parser classes are identified based on their lower case name.
- Parameters
parser_class (type) – parser class (subclass of BaseParser).
- Raises
KeyError – if parser class is already set for the corresponding name.
- classmethod RegisterParsers(parser_classes)[source]
Registers parser classes.
The parser classes are identified based on their lower case name.
- Parameters
parser_classes (list[type]) – parsers classes (subclasses of BaseParser).
- Raises
KeyError – if parser class is already set for the corresponding name.
plaso.parsers.mcafeeav module
Parser for McAfee Anti-Virus Logs.
McAfee AV uses 4 logs to track when scans were run, when virus databases were updated, and when files match the virus database.
- class plaso.parsers.mcafeeav.McafeeAVEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
McAfee AV Log event data.
- action
action.
- Type
str
- filename
filename.
- Type
str
- offset
offset of the line relative to the start of the file, from which the event data was extracted.
- Type
int
- rule
rule.
- Type
str
- status
status.
- Type
str
- trigger_location
trigger location.
- Type
str
- username
username.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'av:mcafee:accessprotectionlog'
- class plaso.parsers.mcafeeav.McafeeAccessProtectionParser[source]
Bases:
DSVParser
Parses the McAfee AV Access Protection Log.
- COLUMNS = ['date', 'time', 'status', 'username', 'filename', 'trigger_location', 'rule', 'action']
- DATA_FORMAT = 'McAfee Anti-Virus access protection log file'
- DELIMITER = '\t'
- NAME = 'mcafee_protection'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns
True if this is the correct parser, False otherwise.
- Return type
bool
plaso.parsers.mediator module
The parser mediator.
- class plaso.parsers.mediator.ParserMediator(knowledge_base, collection_filters_helper=None, resolver_context=None)[source]
Bases:
object
Parser mediator.
- collection_filters_helper
collection filters helper.
- last_activity_timestamp
timestamp received that indicates the last time activity was observed. The last activity timestamp is updated when the mediator produces an attribute container, such as an event source. This timestamp is used by the multi processing worker process to indicate the last time the worker was known to be active. This information is then used by the foreman to detect workers that are not responding (stalled).
- Type
int
- parsers_counter
number of events per parser or parser plugin.
- Type
collections.Counter
- AddWindowsEventLogMessageFile(message_file)[source]
Adds a Windows EventLog message file.
- Parameters
message_file (WindowsEventLogMessageFileArtifact) – Windows EventLog message file.
- AddWindowsEventLogMessageString(message_string)[source]
Adds a Windows EventLog message string.
- Parameters
message_string (WindowsEventLogMessageStringArtifact) – Windows EventLog message string.
- AddWindowsWevtTemplateEvent(event_definition)[source]
Adds a Windows WEVT_TEMPLATE event definition.
- Parameters
event_definition (WindowsWevtTemplateEvent) – Windows WEVT_TEMPLATE event definition.
- AddYearLessLogHelper(year_less_log_helper)[source]
Adds a year-less log helper.
- Parameters
year_less_log_helper (YearLessLogHelper) – year-less log helper.
- AppendToParserChain(name)[source]
Adds a parser or parser plugin to the parser chain.
- Parameters
name (str) – name of a parser or parser plugin.
- ExpandWindowsPath(path)[source]
Expands a Windows path containing environment variables.
- Parameters
path (str) – Windows path with environment variables.
- Returns
expanded Windows path.
- Return type
str
- GetDisplayName(file_entry=None)[source]
Retrieves the display name for a file entry.
- Parameters
file_entry (Optional[dfvfs.FileEntry]) – file entry object, where None will return the display name of self._file_entry.
- Returns
human readable string that describes the path to the file entry.
- Return type
str
- Raises
ValueError – if the file entry is missing.
- GetDisplayNameForPathSpec(path_spec)[source]
Retrieves the display name for a path specification.
- Parameters
path_spec (dfvfs.PathSpec) – path specification.
- Returns
human readable version of the path specification.
- Return type
str
- GetFileEntry()[source]
Retrieves the active file entry.
- Returns
file entry or None if not available.
- Return type
dfvfs.FileEntry
- GetFilename()[source]
Retrieves the name of the active file entry.
- Returns
name of the active file entry or None.
- Return type
str
- GetRelativePath()[source]
Retrieves the relative path of the current file entry.
- Returns
- relative path of the current file entry or None if no current
file entry.
- Return type
str
- GetRelativePathForPathSpec(path_spec)[source]
Retrieves the relative path for a path specification.
- Parameters
path_spec (dfvfs.PathSpec) – path specification.
- Returns
relative path of the path specification.
- Return type
str
- GetWindowsEventLogMessageFile()[source]
Retrieves the Windows EventLog message file for a specific path.
- Returns
- Windows EventLog message file or None
if no current file entry or no Windows EventLog message file was found.
- Return type
- ProduceEventData(event_data)[source]
Produces event data.
- Parameters
event_data (EventData) – event data.
- Raises
RuntimeError – when storage writer is not set.
- ProduceEventDataStream(event_data_stream)[source]
Produces an event data stream.
- Parameters
event_data_stream (EventDataStream) – an event data stream or None if no event data stream is needed.
- Raises
RuntimeError – when storage writer is not set.
- ProduceEventSource(event_source)[source]
Produces an event source.
- Parameters
event_source (EventSource) – an event source.
- Raises
RuntimeError – when storage writer is not set.
- ProduceExtractionWarning(message, path_spec=None)[source]
Produces an extraction warning.
- Parameters
message (str) – message of the warning.
path_spec (Optional[dfvfs.PathSpec]) – path specification, where None will use the path specification of current file entry set in the mediator.
- Raises
RuntimeError – when storage writer is not set.
- ProduceRecoveryWarning(message, path_spec=None)[source]
Produces a recovery warning.
- Parameters
message (str) – message of the warning.
path_spec (Optional[dfvfs.PathSpec]) – path specification, where None will use the path specification of current file entry set in the mediator.
- Raises
RuntimeError – when storage writer is not set.
- SampleFormatCheckStartTiming(parser_name)[source]
Starts timing a CPU time sample for profiling.
- Parameters
parser_name (str) – name of the parser.
- SampleFormatCheckStopTiming(parser_name)[source]
Stops timing a CPU time sample for profiling.
- Parameters
parser_name (str) – name of the parser.
- SampleMemoryUsage(parser_name)[source]
Takes a sample of the memory usage for profiling.
- Parameters
parser_name (str) – name of the parser.
- SampleStartTiming(parser_name)[source]
Starts timing a CPU time sample for profiling.
- Parameters
parser_name (str) – name of the parser.
- SampleStopTiming(parser_name)[source]
Stops timing a CPU time sample for profiling.
- Parameters
parser_name (str) – name of the parser.
- SetExtractWinEvtResources(extract_winevt_resources)[source]
Sets value to indicate if Windows EventLog resources should be extracted.
- Parameters
extract_winevt_resources (bool) – True if Windows EventLog resources should be extracted.
- SetFileEntry(file_entry)[source]
Sets the active file entry.
- Parameters
file_entry (dfvfs.FileEntry) – file entry.
- SetPreferredCodepage(codepage)[source]
Sets the preferred codepage.
- Parameters
codepage (str) – codepage.
- SetPreferredLanguage(language_tag)[source]
Sets the preferred language.
- Parameters
language_tag (str) – language tag such as “en-US” for US English or “is-IS” for Icelandic or None if the language determined by preprocessing or the default should be used.
- Raises
ValueError – if the language tag is not a string type or no LCID can be determined that corresponds with the language tag.
- SetPreferredTimeZone(time_zone_string)[source]
Sets the preferred time zone for zone-less date and time values.
- Parameters
time_zone_string (str) – time zone such as “Europe/Amsterdam” or None if the time zone determined by preprocessing or the default should be used.
- Raises
ValueError – if the time zone is not supported.
- SetStorageWriter(storage_writer)[source]
Sets the storage writer.
- Parameters
storage_writer (StorageWriter) – storage writer.
- SetTemporaryDirectory(temporary_directory)[source]
Sets the directory to store temporary files.
- Parameters
temporary_directory (str) – path of the directory to store temporary files.
- StartProfiling(configuration, identifier, process_information)[source]
Starts profiling.
- Parameters
configuration (ProfilingConfiguration) – profiling configuration.
identifier (str) – identifier of the profiling session used to create the sample filename.
process_information (ProcessInfo) – process information.
- property abort
True if parsing should be aborted.
- Type
bool
- property codepage
preferred codepage in lower case.
- Type
str
- property extract_winevt_resources
extract Windows EventLog resources.
- Type
bool
- property language
language tag in lower case.
- Type
str
- property number_of_produced_event_data
number of produced event data.
- Type
int
- property number_of_produced_event_sources
number of produced event sources.
- Type
int
- property number_of_produced_extraction_warnings
number of produced extraction warnings.
- Type
int
- property resolver_context
resolver context.
- Type
dfvfs.Context
- property temporary_directory
path of the directory for temporary files.
- Type
str
- property timezone
timezone.
- Type
datetime.tzinfo
plaso.parsers.msiecf module
Parser for Microsoft Internet Explorer (MSIE) Cache Files (CF).
- class plaso.parsers.msiecf.MSIECFLeakEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIECF leak event data.
- cached_filename
name of the cached file.
- Type
str
- cached_file_size
size of the cached file.
- Type
int
- cache_directory_index
index of the cache directory.
- Type
int
- cache_directory_name
name of the cache directory.
- Type
str
- offset
offset of the MSIECF item relative to the start of the file, from which the event data was extracted.
- Type
int
- recovered
True if the item was recovered.
- Type
bool
- DATA_TYPE = 'msiecf:leak'
- class plaso.parsers.msiecf.MSIECFParser[source]
Bases:
FileObjectParser
Parses MSIE Cache Files (MSIECF).
- DATA_FORMAT = 'Microsoft Internet Explorer (MSIE) 4 - 9 cache (index.dat) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'msiecf'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a MSIE Cache File (MSIECF) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- class plaso.parsers.msiecf.MSIECFRedirectedEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIECF redirected event data.
- offset
offset of the MSIECF item relative to the start of the file, from which the event data was extracted.
- Type
int
- recovered
True if the item was recovered.
- Type
bool
- url
location URL.
- Type
str
- DATA_TYPE = 'msiecf:redirected'
- class plaso.parsers.msiecf.MSIECFURLEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIECF URL event data.
- access_time
date and time the MSIECF item was last accessed.
- Type
dfdatetime.DateTimeValues
- cached_filename
name of the cached file.
- Type
str
- cached_file_size
size of the cached file.
- Type
int
- cache_directory_index
index of the cache directory.
- Type
int
- cache_directory_name
name of the cache directory.
- Type
str
- creation_time
date and time the MSIECF item was created.
- Type
dfdatetime.DateTimeValues
- expiration_time
date and time the MSIECF item expires.
- Type
dfdatetime.DateTimeValues
- http_headers
HTTP headers.
- Type
str
- modification_time
date and time the MSIECF item was last modified.
- Type
dfdatetime.DateTimeValues
- last_visited_time
date and time the MSIECF item was last visited.
- Type
dfdatetime.DateTimeValues
- number_of_hits
number of hits.
- Type
int
- offset
offset of the MSIECF item relative to the start of the file, from which the event data was extracted.
- Type
int
- primary_time
unspecified primary date and time of the MSIECF item.
- Type
dfdatetime.DateTimeValues
- recovered
True if the item was recovered.
- Type
bool
- secondary_time
unspecified secondary date and time of the MSIECF item.
- Type
dfdatetime.DateTimeValues
- synchronization_time
synchronization date and time.
- Type
dfdatetime.DateTimeValues
- url
location URL.
- Type
str
- DATA_TYPE = 'msiecf:url'
plaso.parsers.networkminer module
Parser for NetworkMiner .fileinfos files.
- class plaso.parsers.networkminer.NetworkMinerEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
NetworkMiner event Data.
- destination_ip
Destination IP address.
- Type
str
- destination_port
Destination port number.
- Type
str
- file_details
Details about the file.
- Type
string
- file_md5
MD5 hash of the file.
- Type
string
- file_path
File path to where it was downloaded.
- Type
string
- file_size
Size of the file.
- Type
string
- filename
Name of the file.
- Type
string
- source_ip
Originating IP address.
- Type
str
- source_port
Originating port number.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'networkminer:fileinfos:file'
- class plaso.parsers.networkminer.NetworkMinerParser[source]
Bases:
DSVParser
Parser for NetworkMiner .fileinfos files.
- COLUMNS = ('source_ip', 'source_port', 'destination_ip', 'destination_port', 'filename', 'file_path', 'file_size', 'unused', 'file_md5', 'unused2', 'file_details', 'unused4', 'timestamp')
- DATA_FORMAT = 'NetworkMiner .fileinfos file'
- NAME = 'networkminer_fileinfo'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row_offset (int) – line number of the row.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns
True if this is the correct parser, False otherwise.
- Return type
bool
plaso.parsers.ntfs module
Parser for NTFS metadata files.
- class plaso.parsers.ntfs.NTFSFileStatEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
NTFS file system stat event data.
- access_time
file entry last access date and time.
- Type
dfdatetime.DateTimeValues
- attribute_type
attribute type for example “0x00000030”, which represents “$FILE_NAME”.
- Type
int
- creation_time
file entry creation date and time.
- Type
dfdatetime.DateTimeValues
- display_name
display name.
- Type
str
- entry_modification_time
file entry modification date and time.
- Type
dfdatetime.DateTimeValues
- file_attribute_flags
NTFS file attribute flags.
- Type
int
- file_reference
NTFS file reference.
- Type
int
- file_system_type
file system type.
- Type
str
- filename
name of the file.
- Type
str
- is_allocated
True if the MFT entry is allocated (marked as in use).
- Type
bool
- modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- name
name associated with the stat event, for example that of a $FILE_NAME attribute or None if not available.
- Type
str
- parent_file_reference
NTFS file reference of the parent.
- Type
int
- path_hints
hints about the full path of the file.
- Type
list[str]
- symbolic_link_target
path of the symbolic link target.
- Type
str
- DATA_TYPE = 'fs:stat:ntfs'
- class plaso.parsers.ntfs.NTFSMFTParser[source]
Bases:
FileObjectParser
Parses a NTFS $MFT metadata file.
- DATA_FORMAT = 'NTFS $MFT metadata file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'mft'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a NTFS $MFT metadata file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- class plaso.parsers.ntfs.NTFSUSNChangeEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
NTFS USN change event data.
- file_attribute_flags
NTFS file attribute flags.
- Type
int
- filename
name of the file associated with the event.
- Type
str
- file_reference
NTFS file reference.
- Type
int
- file_system_type
file system type.
- Type
str
- parent_file_reference
NTFS file reference of the parent.
- Type
int
- offset
offset of the USN record relative to the start of the $J data stream, from which the event data was extracted.
- Type
int
- update_reason_flags
update reason flags.
- Type
int
- update_sequence_number
update sequence number.
- Type
int
- update_source_flags
update source flags.
- Type
int
- update_time
update date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'fs:ntfs:usn_change'
- class plaso.parsers.ntfs.NTFSUsnJrnlParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses a NTFS USN change journal.
- DATA_FORMAT = 'NTFS USN change journal ($UsnJrnl:$J) file system metadata file'
- NAME = 'usnjrnl'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a NTFS $UsnJrnl metadata file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.olecf module
Parser for OLE Compound Files (OLECF).
- class plaso.parsers.olecf.OLECFParser[source]
Bases:
FileObjectParser
Parses OLE Compound Files (OLECF).
- DATA_FORMAT = 'OLE Compound File (OLECF) format'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'olecf'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an OLE Compound File (OLECF) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.opera module
Parsers for Opera Browser history files.
- class plaso.parsers.opera.OperaGlobalHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Opera global history entry data.
- description
description.
- Type
str
- last_visited_time
date and time the URL was last visited.
- Type
dfdatetime.DateTimeValues
- popularity_index
popularity index.
- Type
int
- title
title.
- Type
str
- url
URL.
- Type
str
- DATA_TYPE = 'opera:history:entry'
- class plaso.parsers.opera.OperaGlobalHistoryParser[source]
Bases:
FileObjectParser
Parses the Opera global_history.dat file.
- DATA_FORMAT = 'Opera global history (global_history.dat) file'
- NAME = 'opera_global'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Opera global history file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.opera.OperaTypedHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Opera typed history entry data.
- entry_selection
information about whether the URL was directly typed in or the result of the user choosing from the auto complete.
- Type
str
- entry_type
information about whether the URL was directly typed in or the result of the user choosing from the auto complete.
- Type
str
- last_typed_time
date and time the URL was last typed.
- Type
dfdatetime.DateTimeValues
- url
typed URL or hostname.
- Type
str
- DATA_TYPE = 'opera:history:typed_entry'
- class plaso.parsers.opera.OperaTypedHistoryParser[source]
Bases:
FileObjectParser
Parses the Opera typed_history.xml file.
- DATA_FORMAT = 'Opera typed history (typed_history.xml) file'
- NAME = 'opera_typed_history'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Opera typed history file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.pe module
A parser for Portable Executable (PE) files.
- class plaso.parsers.pe.PEDLLImportEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Portable Executable (PE) DLL import event data.
- delayed_import
True if the DLL is imported at run-time.
- Type
bool
- modification_time
last modification date and time.
- Type
dfdatetime.DateTimeValues
- name
name of the imported DLL.
- Type
str
- DATA_TYPE = 'pe_coff:dll_import'
- class plaso.parsers.pe.PEFileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Portable Executable (PE) file event data.
- creation_time
creation date and time.
- Type
dfdatetime.DateTimeValues
- export_dll_name
name of the exported DLL.
- Type
str
- export_table_modification_time
export table last modification date and time.
- Type
dfdatetime.DateTimeValues
- imphash
“Import Hash” of the Portable Executable (PE) file.
- Type
str
- load_configuration_table_modification_time
load configuration table last modification date and time.
- Type
dfdatetime.DateTimeValues
- pe_type
type of Portable Executable (PE) file.
- Type
str
- section_names
names of the sections in the Portable Executable (PE) file.
- Type
list[str]
- DATA_TYPE = 'pe_coff:file'
- class plaso.parsers.pe.PEParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Portable Executable (PE) files.
- DATA_FORMAT = 'Portable Executable (PE) file'
- NAME = 'pe'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Portable Executable (PE) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.pe.PEResourceEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Portable Executable (PE) resource event data.
- identifier
identifier of the resource.
- Type
int
- modification_time
last modification date and time.
- Type
dfdatetime.DateTimeValues
- name
name of the resource.
- Type
str
- DATA_TYPE = 'pe_coff:resource'
plaso.parsers.plist module
Parser for binary and text Property List (plist) files.
- class plaso.parsers.plist.PlistParser[source]
Bases:
FileObjectParser
Parser for binary and text Property List (plist) files.
- DATA_FORMAT = 'Property list (plist) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
a format specification or None if not available.
- Return type
- NAME = 'plist'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a plist file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.pls_recall module
Parser for PL/SQL Developer Recall files.
- class plaso.parsers.pls_recall.PlsRecallEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
PL/SQL Recall event data.
- database_name
name of the database.
- Type
str
- offset
offset of the PL/SQL Recall record relative to the start of the file, from which the event data was extracted.
- Type
int
- query
PL/SQL query.
- Type
str
- sequence_number
sequence number.
- Type
int
- username
username used to query.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'pls_recall:entry'
- class plaso.parsers.pls_recall.PlsRecallParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parse PL/SQL Recall files.
This parser is based on the Delphi definition of the data type:
- TRecallRecord = packed record
Sequence: Integer; TimeStamp: TDateTime; Username: array[0..30] of Char; Database: array[0..80] of Char; Text: array[0..4000] of Char;
end;
Delphi TDateTime is a little-endian 64-bit floating-point value without time zone information.
- DATA_FORMAT = 'PL SQL cache file (PL-SQL developer recall file) format'
- NAME = 'pls_recall'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a PLSRecall.dat file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.plugins module
This file contains basic interface for plugins within Plaso.
This library serves a basis for all plugins in Plaso, whether that are Windows Registry plugins, SQLite plugins or any other parsing plugins.
This is provided as a separate file to make it easier to inherit in other projects that may want to use the Plaso plugin system.
- class plaso.parsers.plugins.BasePlugin[source]
Bases:
object
A plugin is a lightweight parser that makes use of a common data structure.
When a data structure is common among several artifacts or files a plugin infrastructure can be written to make writing parsers simpler. The goal of a parser plugin is to have only a single parser that understands the data structure that can call plugins that have specialized knowledge of certain structures.
An example of this is a SQLite database. A plugin can be written that has knowledge of certain database, such as Chrome history, or Skype history, etc. This can be done without needing to write a fully-fledged parser that needs to re-implement the data structure knowledge. A single parser can be created that calls the plugins to see if it knows that particular database.
Another example is Windows Registry, there a single parser that can parse the Registry can be made and the job of a single plugin is to parse a particular Registry key. The parser can then read a Registry key and compare it to a list of available plugins to see if it can be parsed.
- DATA_FORMAT = ''
- NAME = 'base_plugin'
- Process(parser_mediator, **kwargs)[source]
Extracts events using a parser plugin.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
kwargs (dict[str, object]) – Depending on the plugin they may require different sets of arguments to be able to evaluate whether or not this is the correct plugin.
- Raises
ValueError – when there are unused keyword arguments.
- UpdateChainAndProcess(parser_mediator, **kwargs)[source]
Extracts events using a parser plugin and synchronizes the parser chain.
This method updates the parser chain object held by the mediator, transfers control to the plugin-specific Process() method, and updates the chain again once the processing is complete.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
- class plaso.parsers.plugins.BasePluginCache[source]
Bases:
object
A generic cache for parser plugins.
- GetResults(attribute, default_value=None)[source]
Retrieves a cached attribute.
- Parameters
attribute (str) – name of the cached attribute.
default_value (Optional[object]) – default value.
- Returns
- value of the cached attribute or default value if the cache
does not contain the attribute.
- Return type
object
plaso.parsers.presets module
The parser and parser plugin presets.
- class plaso.parsers.presets.ParserPreset(name, parsers)[source]
Bases:
object
Parser and parser plugin preset.
- deprecated
True if the preset is deprecated.
- Type
bool
- name
name of the preset.
- Type
str
- operating_systems
operating system artifact attribute containers, that specify to which operating systems the preset applies.
- Type
list[OperatingSystemArtifact]
- parsers
names of parser and parser plugins.
- Type
list[str]
- class plaso.parsers.presets.ParserPresetsManager[source]
Bases:
object
The parsers and plugin presets manager.
- GetNames()[source]
Retrieves the preset names.
- Returns
preset names in alphabetical order.
- Return type
list[str]
- GetParsersByPreset(preset_name)[source]
Retrieves the parser and plugin names of a specific preset.
- Parameters
preset_name (str) – name of the preset.
- Returns
parser and plugin names in alphabetical order.
- Return type
list[str]
- Raises
KeyError – if the preset does not exist.
- GetPresetByName(name)[source]
Retrieves a specific preset definition by name.
- Parameters
name (str) – name of the preset.
- Returns
a parser preset or None if not available.
- Return type
- GetPresetsByOperatingSystem(operating_system)[source]
Retrieves preset definitions for a specific operating system.
- Parameters
operating_system (OperatingSystemArtifact) – an operating system artifact attribute container.
- Returns
- preset definition that correspond with the
operating system.
- Return type
list[PresetDefinition]
- GetPresetsInformation()[source]
Retrieves the presets information.
- Returns
containing:
str: preset name. str: comma separated parser and plugin names that are defined by
the preset.
- Return type
list[tuple]
- ReadFromFile(path)[source]
Reads parser and parser plugin presets from a file.
- Parameters
path (str) – path of file that contains the the parser and parser plugin presets configuration.
- Raises
MalformedPresetError – if one or more plugin preset definitions are malformed.
plaso.parsers.recycler module
Parser for Windows Recycle files, INFO2 and $I/$R pairs.
- class plaso.parsers.recycler.WinRecycleBinEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Recycle Bin event data.
- deletion_time
file entry deletion date and time.
- Type
dfdatetime.DateTimeValues
- drive_number
drive number.
- Type
int
- file_size
file size.
- Type
int
- offset
offset of the Recycle Bin record relative to the start of the file, from which the event data was extracted.
- Type
int
- original_filename
filename.
- Type
str
- record_index
index of the record, from which the event data was extracted.
- Type
int
- short_filename
short filename.
- Type
str
- DATA_TYPE = 'windows:metadata:deleted_item'
- class plaso.parsers.recycler.WinRecycleBinParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses the Windows $Recycle.Bin $I files.
- DATA_FORMAT = 'Windows $Recycle.Bin $I file'
- NAME = 'recycle_bin'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Recycle.Bin metadata ($I) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.recycler.WinRecyclerInfo2Parser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses the Windows Recycler INFO2 file.
- DATA_FORMAT = 'Windows Recycler INFO2 file'
- NAME = 'recycle_bin_info2'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Recycler INFO2 file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.spotlight_storedb module
Parser for Apple Spotlight store database files.
- class plaso.parsers.spotlight_storedb.SpotlightStoreDatabaseParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Apple Spotlight store database (store.db) files.
- DATA_FORMAT = 'Apple Spotlight store database (store.db) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'spotlight_storedb'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Apple Spotlight store database file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataAttribute[source]
Bases:
object
Metadata attribute.
- key
key or name of the metadata attribute.
- Type
str
- property_type
metadata attribute property type.
- Type
int
- value
metadata attribute value.
- Type
object
- value_type
metadata attribute value type.
- Type
int
- class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataItem[source]
Bases:
object
Metadata item.
- attributes
metadata attributes.
- Type
dict[str, SpotlightStoreMetadataAttribute]
- data_size
size of the record data.
- Type
int
- flags
record flags.
- Type
int
- identifier
file (system) entry identifier.
- Type
int
- item_identifier
item identifier.
- Type
int
- last_update_time
last update time.
- Type
int
- parent_identifier
parent file (system) entry identifier.
- Type
int
- class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataItemEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple Spotlight store database metadata item event data.
- added_time
date and time the item was added (kMDItemDateAdded).
- Type
dfdatetime.DateTimeValues
- attribute_change_time
date and time an attribute was last changed (kMDItemAttributeChangeDate).
- Type
dfdatetime.DateTimeValues
- content_creation_time
date and time the content was created (kMDItemContentCreationDate).
- Type
dfdatetime.DateTimeValues
- content_modification_time
date and time the content was last modified (kMDItemContentModificationDate).
- Type
dfdatetime.DateTimeValues
- content_type
content type of the corresponding file (system) entry (kMDItemContentType).
- Type
str
- creation_time
date and time the item was created (_kMDItemCreationDate).
- Type
dfdatetime.DateTimeValues
- downloaded_time
date and time the item was downloaded (kMDItemDownloadedDate).
- Type
dfdatetime.DateTimeValues
- file_name
name of the corresponding file (system) entry (_kMDItemFileName).
- Type
str
- file_system_identifier
file system identifier, for example the catalog node identifier (CNID) on HFS.
- Type
int
- kind
item kind (kMDItemKind).
- Type
str
- modification_time
date and time the item was last modified (_kMDItemContentChangeDate).
- Type
dfdatetime.DateTimeValues
- parent_file_system_identifier
file system identifier of the parent.
- Type
int
- purchase_time
date and time the item was purchased in the AppStore (kMDItemAppStorePurchaseDate).
- Type
dfdatetime.DateTimeValues
- snapshot_times
dates and times of the creation of backup snaphots (_kTimeMachineOldestSnapshot and _kTimeMachineNewestSnapshot).
- Type
list[dfdatetime.DateTimeValues]
- update_time
date and time the item was last updated.
- Type
dfdatetime.DateTimeValues
- used_times
dates and times when the item was used (kMDItemUsedDates and kMDItemLastUsedDate).
- Type
list[dfdatetime.DateTimeValues]
- DATA_TYPE = 'spotlight:metadata_item'
plaso.parsers.sqlite module
SQLite parser.
- class plaso.parsers.sqlite.SQLiteCache[source]
Bases:
BasePluginCache
Cache for storing results of SQL queries.
- CacheQueryResults(sql_results, attribute_name, key_name, column_names)[source]
Build a dictionary object based on a SQL command.
This function will take a SQL command, execute it and for each resulting row it will store a key in a dictionary.
An example:
sql_results = A SQL result object after executing the SQL command: 'SELECT foo, bla, bar FROM my_table' attribute_name = 'all_the_things' key_name = 'foo' column_names = ['bla', 'bar']
Results from running this against the database: ‘first’, ‘stuff’, ‘things’ ‘second’, ‘another stuff’, ‘another thing’
This will result in a dictionary object being created in the cache, called ‘all_the_things’ and it will contain the following value:
all_the_things = { 'first': ['stuff', 'things'], 'second': ['another_stuff', 'another_thing'], 'third': ['single_thing']}
- Parameters
sql_results (sqlite3.Cursor) – result after executing a SQL command on a database.
attribute_name (str) – attribute name in the cache to store results to. This will be the name of the dictionary attribute.
key_name (str) – name of the result field that should be used as a key in the resulting dictionary that is created.
column_names (list[str]) – of column names that are stored as values to the dictionary. If this list has only one value in it the value will be stored directly, otherwise the value will be a list containing the extracted results based on the names provided in this list.
- GetRowCache(query)[source]
Retrieves the row cache for a specific query.
The row cache is a set that contains hashes of values in a row. The row cache is used to find duplicate row when a database and a database with a WAL file is parsed.
- Parameters
query (str) – query.
- Returns
hashes of the rows that have been parsed.
- Return type
set
- class plaso.parsers.sqlite.SQLiteDatabase(filename, temporary_directory=None)[source]
Bases:
object
SQLite database.
- schema
schema as an SQL query per table name, for example {‘Users’: ‘CREATE TABLE Users (“id” INTEGER PRIMARY KEY, …)’}.
- Type
dict[str, str]
- Open(file_object, wal_file_object=None)[source]
Opens a SQLite database file.
Since pysqlite cannot read directly from a file-like object a temporary copy of the file is made. After creating a copy the database file this function sets up a connection with the database and determines the names of the tables.
- Parameters
file_object (dfvfs.FileIO) – file-like object.
wal_file_object (Optional[dfvfs.FileIO]) – file-like object for the Write-Ahead Log (WAL) file.
- Raises
IOError – if the file-like object cannot be read.
OSError – if the file-like object cannot be read.
sqlite3.DatabaseError – if the database cannot be parsed.
ValueError – if the file-like object is missing.
- Query(query)[source]
Queries the database.
- Parameters
query (str) – SQL query.
- Returns
results.
- Return type
sqlite3.Cursor
- Raises
sqlite3.DatabaseError – if querying the database fails.
- SCHEMA_QUERY = 'SELECT tbl_name, sql FROM sqlite_master WHERE type = "table" AND tbl_name != "xp_proc" AND tbl_name != "sqlite_sequence"'
- property tables
names of all the tables.
- Type
list[str]
- class plaso.parsers.sqlite.SQLiteParser[source]
Bases:
FileEntryParser
Parses SQLite database files.
- DATA_FORMAT = 'SQLite database file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
a format specification or None if not available.
- Return type
- NAME = 'sqlite'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses a SQLite database file entry.
- Parameters
parser_mediator (ParserMediator) – parser mediator.
file_entry (dfvfs.FileEntry) – file entry to be parsed.
plaso.parsers.symantec module
Symantec AV Corporate Edition and Endpoint Protection log file parser.
- class plaso.parsers.symantec.SymantecEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Symantec event data.
- access
access.
- Type
str
- action0
action0.
- Type
str
- action1
action1.
- Type
str
- action1_status
action1 status.
- Type
str
- action2
action2.
- Type
str
- action2_status
action2 status.
- Type
str
- address
address.
- Type
str
- backup_id
backup identifier.
- Type
str
- cat
category.
- Type
str
- cleaninfo
clean information.
- Type
str
- clientgroup
client group.
- Type
str
- compressed
compressed.
- Type
str
- computer
computer.
- Type
str
- definfo
definfo.
- Type
str
- defseqnumber
def sequence number.
- Type
str
- deleteinfo
delete information.
- Type
str
- depth
depth.
- Type
str
- description
description.
- Type
str
- domain_guid
domain identifier (GUID).
- Type
str
- domainname
domain name.
- Type
str
- err_code
error code.
- Type
str
- event_data
event data.
- Type
str
- event
event.
- Type
str
- extra
extra.
- Type
str
- file
file.
- Type
str
- flags
flags.
- Type
str
- groupid
group identifier.
- Type
str
- guid
guid.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- license_expiration_dt
license expiration date.
- Type
str
- license_feature_name
license feature name.
- Type
str
- license_feature_ver
license feature ver.
- Type
str
- license_fulfillment_id
license fulfillment identifier.
- Type
str
- license_lifecycle
license lifecycle.
- Type
str
- license_seats_delta
license seats delta.
- Type
str
- license_seats
license seats.
- Type
str
- license_seats_total
license seats total.
- Type
str
- license_serial_num
license serial number.
- Type
str
- license_start_dt
license start date.
- Type
str
- logger
logger.
- Type
str
- login_domain
login domain.
- Type
str
- log_session_guid
log session identifier (GUID).
- Type
str
- macaddr
MAC address.
- Type
str
- new_ext
new ext.
- Type
str
- ntdomain
ntdomain.
- Type
str
- offset
offset.
- Type
str
- parent
parent.
- Type
str
- quarfwd_status
quarfwd status.
- Type
str
- remote_machine_ip
remote machine IP address.
- Type
str
- remote_machine
remote machine.
- Type
str
- scanid
scan identifier.
- Type
str
- snd_status
snd status.
- Type
str
- status
status.
- Type
str
- still_infected
still infected.
- Type
str
- time
time.
- Type
str
- user
user.
- Type
str
- vbin_id
vbin identifier.
- Type
str
- vbin_session_id
vbin session identifier.
- Type
str
- version
version.
- Type
str
- virus_id
virus identifier.
- Type
str
- virus
virus.
- Type
str
- virustype
virustype.
- Type
str
- DATA_TYPE = 'av:symantec:scanlog'
- class plaso.parsers.symantec.SymantecParser[source]
Bases:
DSVParser
Parses Symantec AV Corporate Edition and Endpoint Protection log files.
- COLUMNS = ['time', 'event', 'cat', 'logger', 'computer', 'user', 'virus', 'file', 'action1', 'action2', 'action0', 'virustype', 'flags', 'description', 'scanid', 'new_ext', 'groupid', 'event_data', 'vbin_id', 'virus_id', 'quarfwd_status', 'access', 'snd_status', 'compressed', 'depth', 'still_infected', 'definfo', 'defseqnumber', 'cleaninfo', 'deleteinfo', 'backup_id', 'parent', 'guid', 'clientgroup', 'address', 'domainname', 'ntdomain', 'macaddr', 'version:', 'remote_machine', 'remote_machine_ip', 'action1_status', 'action2_status', 'license_feature_name', 'license_feature_ver', 'license_serial_num', 'license_fulfillment_id', 'license_start_dt', 'license_expiration_dt', 'license_lifecycle', 'license_seats_total', 'license_seats', 'err_code', 'license_seats_delta', 'status', 'domain_guid', 'log_session_guid', 'vbin_session_id', 'login_domain', 'extra']
- DATA_FORMAT = 'Symantec AV Corporate Edition and Endpoint Protection log file'
- NAME = 'symantec_scanlog'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – line number of the row.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns
True if this is the correct parser, False otherwise.
- Return type
bool
plaso.parsers.systemd_journal module
Parser for Systemd journal files.
- class plaso.parsers.systemd_journal.SystemdJournalEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Systemd journal event data.
- body
message body.
- Type
str
- hostname
hostname.
- Type
str
- pid
process identifier (PID).
- Type
int
- reporter
reporter.
- Type
str
- written_time
date and time the log entry was written.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'systemd:journal'
- class plaso.parsers.systemd_journal.SystemdJournalParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses Systemd Journal files.
- DATA_FORMAT = 'Systemd journal file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'systemd_journal'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Systemd journal file-like object.
- Parameters
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the header cannot be parsed.
plaso.parsers.text_parser module
Text log parser.
- class plaso.parsers.text_parser.EncodedTextReader(file_object, encoding='utf-8', encoding_errors='strict')[source]
Bases:
object
Encoded text reader.
- lines
lines of text.
- Type
str
- BUFFER_SIZE = 65536
- class plaso.parsers.text_parser.TextLogParser[source]
Bases:
FileObjectParser
Text-based log file parser.
- DATA_FORMAT = 'text-based log file'
- EnablePlugins(plugin_includes)[source]
Enables parser plugins.
- Parameters
plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.
- NAME = 'text'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a text log file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.trendmicroav module
Parser for Trend Micro Antivirus logs.
Trend Micro uses two log files to track the scans (both manual/scheduled and real-time) and the web reputation (network scan/filtering).
Currently only the first log is supported.
- class plaso.parsers.trendmicroav.OfficeScanVirusDetectionParser[source]
Bases:
TrendMicroBaseParser
Parses the Trend Micro Office Scan Virus Detection Log.
- COLUMNS = ['date', 'time', 'threat', 'action', 'scan_type', 'unused1', 'path', 'filename', 'unused2', 'timestamp', 'unused3', 'unused4']
- DATA_FORMAT = 'Trend Micro Office Scan Virus Detection log file'
- NAME = 'trendmicro_vd'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns
True if this is the correct parser, False otherwise.
- Return type
bool
- class plaso.parsers.trendmicroav.OfficeScanWebReputationParser[source]
Bases:
TrendMicroBaseParser
Parses the Trend Micro Office Scan Web Reputation detection log.
- COLUMNS = ('date', 'time', 'block_mode', 'url', 'group_code', 'group_name', 'credibility_rating', 'policy_identifier', 'application_name', 'credibility_score', 'ip', 'threshold', 'timestamp', 'unused')
- DATA_FORMAT = 'Trend Micro Office Web Reputation log file'
- NAME = 'trendmicro_url'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns
True if this is the correct parser, False otherwise.
- Return type
bool
- class plaso.parsers.trendmicroav.TrendMicroAVEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Trend Micro AV Log event data.
- action
action.
- Type
str
- filename
filename.
- Type
str
- offset
offset of the line relative to the start of the file, from which the event data was extracted.
- Type
int
- path
path.
- Type
str
- scan_type
scan_type.
- Type
str
- threat
threat.
- Type
str
- written_time
date and time the log entry was written.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'av:trendmicro:scan'
- class plaso.parsers.trendmicroav.TrendMicroBaseParser[source]
Bases:
DSVParser
Common code for parsing Trend Micro log files.
The file format is reminiscent of CSV, but is not quite the same; the delimiter is a three-character sequence and there is no provision for quoting or escaping.
- COLUMNS = ()
- DELIMITER = '<;>'
- class plaso.parsers.trendmicroav.TrendMicroUrlEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Trend Micro Web Reputation Log event data.
- application_name
application name.
- Type
str
- block_mode
operation mode.
- Type
str
- credibility_rating
credibility rating.
- Type
int
- credibility_score
credibility score.
- Type
int
- group_code
group code.
- Type
str
- group_name
group name.
- Type
str
- ip
IP address.
- Type
str
- offset
offset of the line relative to the start of the file, from which the event data was extracted.
- Type
int
- policy_identifier
policy identifier.
- Type
int
- threshold
threshold value.
- Type
int
- url
accessed URL.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'av:trendmicro:webrep'
plaso.parsers.utmp module
Parser for Linux utmp files.
- class plaso.parsers.utmp.UtmpEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Linux libc6 utmp event data.
- exit_status
exit status.
- Type
int
- hostname
hostname or IP address.
- Type
str
- ip_address
IP address from the connection.
- Type
str
- offset
offset of the utmp record relative to the start of the file, from which the event data was extracted.
- Type
int
- pid
process identifier (PID).
- Type
int
- terminal_identifier
inittab identifier.
- Type
int
- terminal
type of terminal.
- Type
str
- type
type of login.
- Type
int
- username
user name.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'linux:utmp:event'
- class plaso.parsers.utmp.UtmpParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Linux libc6 utmp files.
- DATA_FORMAT = 'Linux libc6 utmp file'
- NAME = 'utmp'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an utmp file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.utmpx module
Parser for MacOS utmpx files.
- class plaso.parsers.utmpx.UtmpxMacOSEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS utmpx event data.
- hostname
hostname or IP address.
- Type
str
- offset
offset of the utmpx record relative to the start of the file, from which the event data was extracted.
- Type
int
- pid
process identifier (PID).
- Type
int
- terminal
name of the terminal.
- Type
str
- terminal_identifier
inittab identifier.
- Type
int
- type
type of login.
- Type
int
- username
user name.
- Type
str
- written_time
entry written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'macos:utmpx:entry'
- class plaso.parsers.utmpx.UtmpxParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Mac OS X 10.5 utmpx files.
- DATA_FORMAT = 'Mac OS X 10.5 utmpx file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'utmpx'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an UTMPX file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
plaso.parsers.windefender_history module
Parser for Windows Defender scan DetectionHistory files.
- class plaso.parsers.windefender_history.WinDefenderHistoryParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses a Windows Defender scan DetectionHistory file.
- DATA_FORMAT = 'Windows Defender scan DetectionHistory file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'windefender_history'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Defender History file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.windefender_history.WindowsDefenderHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Defender scan DetectionHistory event data.
- additional_filenames
locations of additional detected files.
- Type
list[str]
- container_filenames
location of files detected inside a container.
- Type
list[str]
- filename
name of the file that the threat was detected in.
- Type
str
- host_and_user
name of the host and user in “DOMAINUSER” format.
- Type
str
- process
name of the process that caused the detection.
- Type
str
- recorded_time
date and time the log entry was recorded.
- Type
dfdatetime.DateTimeValues
- sha256
SHA-256 hash of the file.
- Type
str
- threat_name
name of the threat that was detected.
- Type
str
- web_filenames
URI of files detected as downloaded from the web.
- Type
list[str]
- DATA_TYPE = 'av:defender:detection_history'
plaso.parsers.winevt module
Parser for Windows EventLog (EVT) files.
- class plaso.parsers.winevt.WinEvtParser[source]
Bases:
FileObjectParser
Parses Windows EventLog (EVT) files.
- DATA_FORMAT = 'Windows EventLog (EVT) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'winevt'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows EventLog (EVT) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- class plaso.parsers.winevt.WinEvtRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows EventLog (EVT) record event data.
- creation_time
event record creation date and time.
- Type
dfdatetime.DateTimeValues
- computer_name
computer name stored in the event record.
- Type
str
- event_category
event category.
- Type
int
- event_identifier
event identifier.
- Type
int
- event_type
event type.
- Type
int
- facility
event facility.
- Type
int
- message_identifier
event message identifier.
- Type
int
- offset
offset of the event record relative to the start of the file, from which the event data was extracted.
- Type
int
- record_number
event record number.
- Type
int
- recovered
True if the record was recovered.
- Type
bool
- severity
event severity.
- Type
int
- source_name
name of the event source.
- Type
str
- strings
event strings.
- Type
list[str]
- user_sid
user security identifier (SID) stored in the event record.
- Type
str
- written_time
event record written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:evt:record'
plaso.parsers.winevtx module
Parser for Windows XML EventLog (EVTX) files.
- class plaso.parsers.winevtx.WinEvtxParser[source]
Bases:
FileObjectParser
Parses Windows XML EventLog (EVTX) files.
- DATA_FORMAT = 'Windows XML EventLog (EVTX) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'winevtx'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows XML EventLog (EVTX) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- class plaso.parsers.winevtx.WinEvtxRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows XML EventLog (EVTX) record event data.
- creation_time
event record creation date and time.
- Type
dfdatetime.DateTimeValues
- computer_name
computer name stored in the event record.
- Type
str
- event_identifier
event identifier.
- Type
int
- event_level
event level.
- Type
int
- event_version
event version.
- Type
int
- message_identifier
event message identifier.
- Type
int
- offset
offset of the EVTX record relative to the start of the file, from which the event data was extracted.
- Type
int
- provider_identifier
identifier of the EventLog provider.
- Type
str
- record_number
event record number.
- Type
int
- recovered
True if the record was recovered.
- Type
bool
- source_name
name of the event source.
- Type
str
- strings
event strings.
- Type
list[str]
- user_sid
user security identifier (SID) stored in the event record.
- Type
str
- written_time
event record written date and time.
- Type
dfdatetime.DateTimeValues
- xml_string
XML representation of the event.
- Type
str
- DATA_TYPE = 'windows:evtx:record'
plaso.parsers.winjob module
Parser for Windows Scheduled Task job files.
- class plaso.parsers.winjob.WinJobEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Scheduled Task event data.
- application
path to job executable.
- Type
str
- comment
description of the scheduled task.
- Type
str
- last_run_time
executable (binary) last run date and time.
- Type
dfdatetime.DateTimeValues
- parameters
application command line parameters.
- Type
str
- username
username that scheduled the task.
- Type
str
- working_directory
working directory of the scheduled task.
- Type
str
- DATA_TYPE = 'windows:tasks:job'
- class plaso.parsers.winjob.WinJobParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parse Windows Scheduled Task files for job events.
- DATA_FORMAT = 'Windows Scheduled Task job (or at-job) file'
- NAME = 'winjob'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows job file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises
WrongParser – when the file cannot be parsed.
- class plaso.parsers.winjob.WinJobTriggerEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Scheduled Task trigger event data.
- application
path to job executable.
- Type
str
- comment
description of the scheduled task.
- Type
str
- end_time
date and time the end of the trigger.
- Type
dfdatetime.DateTimeValues
- parameters
application command line parameters.
- Type
str
- start_time
date and time the start of the trigger.
- Type
dfdatetime.DateTimeValues
- trigger_type
trigger type.
- Type
int
- username
username that scheduled the task.
- Type
str
- working_directory
working directory of the scheduled task.
- Type
str
- DATA_TYPE = 'windows:tasks:trigger'
plaso.parsers.winlnk module
Parser for Windows Shortcut (LNK) files.
- class plaso.parsers.winlnk.WinLnkLinkEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Shortcut (LNK) link event data.
- access_time
file entry last access date and time.
- Type
dfdatetime.DateTimeValues
- birth_droid_file_identifier
distributed link tracking birth droid file identifier.
- Type
str
- birth_droid_volume_identifier
distributed link tracking birth droid volume identifier.
- Type
str
- command_line_arguments
command line arguments.
- Type
str
- creation_time
file entry creation date and time.
- Type
dfdatetime.DateTimeValues
- description
description of the linked item.
- Type
str
- drive_serial_number
drive serial number where the linked item resides.
- Type
int
- drive_type
drive type where the linked item resided.
- Type
str
- droid_file_identifier
distributed link tracking droid file identifier.
- Type
str
- droid_volume_identifier
distributed link tracking droid volume identifier.
- Type
str
- env_var_location
environment variables loction.
- Type
str
- file_attribute_flags
file attribute flags of the linked item.
- Type
int
- file_size
size of the linked item.
- Type
int
- icon_location
icon location.
- Type
str
- link_target
shell item list of the link target.
- Type
str
- local_path
local path of the linked item.
- Type
str
- modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- network_path
local path of the linked item.
- Type
str
- relative_path
relative path.
- Type
str
- volume_label
volume label where the linked item resided.
- Type
str
- working_directory
working directory.
- Type
str
- DATA_TYPE = 'windows:lnk:link'
- class plaso.parsers.winlnk.WinLnkParser[source]
Bases:
FileObjectParser
Parses Windows Shortcut (LNK) files.
- DATA_FORMAT = 'Windows Shortcut (LNK) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'lnk'
- ParseFileLNKFile(parser_mediator, file_object, display_name)[source]
Parses a Windows Shortcut (LNK) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
display_name (str) – display name.
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Shortcut (LNK) file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.winprefetch module
Parser for Windows Prefetch files.
- class plaso.parsers.winprefetch.WinPrefetchExecutionEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Prefetch event data.
- executable
executable filename.
- Type
str
- format_version
format version.
- Type
int
- last_run_time
executable (binary) last run date and time.
- Type
dfdatetime.DateTimeValues
- mapped_files
mapped filenames.
- Type
list[str]
- number_of_volumes
number of volumes.
- Type
int
- path_hints
possible full paths to the executable.
- Type
list[str]
- prefetch_hash
prefetch hash.
- Type
int
- previous_run_times
previous executable (binary) run date and time.
- Type
list[dfdatetime.DateTimeValues]
- run_count
run count.
- Type
int
- volume_device_paths
volume device paths.
- Type
list[str]
- volume_serial_numbers
volume serial numbers.
- Type
list[int]
- DATA_TYPE = 'windows:prefetch:execution'
- class plaso.parsers.winprefetch.WinPrefetchParser[source]
Bases:
FileObjectParser
A parser for Windows Prefetch files.
- DATA_FORMAT = 'Windows Prefetch File (PF)'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns
format specification.
- Return type
- NAME = 'prefetch'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Prefetch file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.winreg_parser module
Parser for Windows NT Registry (REGF) files.
- class plaso.parsers.winreg_parser.WinRegistryParser[source]
Bases:
FileObjectParser
Parses Windows NT Registry (REGF) files.
- DATA_FORMAT = 'Windows NT Registry (REGF) file'
- EnablePlugins(plugin_includes)[source]
Enables parser plugins.
- Parameters
plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.
- NAME = 'winreg'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Registry file-like object.
- Parameters
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – a file-like object.
plaso.parsers.winrestore module
Parser for Windows Restore Point (rp.log) files.
- class plaso.parsers.winrestore.RestorePointEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Restore Point event data.
- creation_time
creation date and time.
- Type
dfdatetime.DateTimeValues
- description
description.
- Type
str
- restore_point_event_type
restore point event type.
- Type
str
- restore_point_type
restore point type.
- Type
str
- sequence_number
sequence number.
- Type
str
- DATA_TYPE = 'windows:restore_point:info'
- class plaso.parsers.winrestore.RestorePointLogParser[source]
Bases:
FileObjectParser
,DtFabricHelper
A parser for Windows Restore Point (rp.log) files.
- DATA_FORMAT = 'Windows Restore Point log (rp.log) file'
- FILTERS = frozenset({<plaso.parsers.interface.FileNameFileEntryFilter object>})
- NAME = 'rplog'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Restore Point (rp.log) log file-like object.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises
WrongParser – when the file cannot be parsed.
Module contents
This file imports Python modules that register parsers.