plaso.parsers.shared package
Submodules
plaso.parsers.shared.shell_items module
Parser for Windows NT shell items.
- class plaso.parsers.shared.shell_items.ShellItemsParser(origin)[source]
Bases:
object
Parses for Windows NT shell items.
- CopyToPath()[source]
Copies the shell items to a path.
- Returns
converted shell item list path or None.
- Return type
str
- GetUpperPathSegment()[source]
Retrieves the upper shell item path segment.
- Returns
shell item path segment or “N/A”.
- Return type
str
- NAME = 'shell_items'
- ParseByteStream(parser_mediator, byte_stream, parent_path_segments=None, codepage='cp1252')[source]
Parses the shell items from the byte stream.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
byte_stream (bytes) – shell items data.
parent_path_segments (Optional[list[str]]) – parent shell item path segments.
codepage (Optional[str]) – byte stream codepage.