plaso.parsers.shared package


plaso.parsers.shared.shell_items module

Parser for Windows NT shell items.

class plaso.parsers.shared.shell_items.ShellItemsParser(origin)[source]

Bases: object

Parses for Windows NT shell items.


Copies the shell items to a path.

Returns:converted shell item list path or None.
Return type:str

Retrieves the upper shell item path segment.

Returns:shell item path segment or “N/A”.
Return type:str
NAME = 'shell_items'
ParseByteStream(parser_mediator, byte_stream, parent_path_segments=None, codepage='cp1252')[source]

Parses the shell items from the byte stream.

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
  • byte_stream (bytes) – shell items data.
  • parent_path_segments (Optional[list[str]]) – parent shell item path segments.
  • codepage (Optional[str]) – byte stream codepage.

Module contents