plaso.parsers.winreg_plugins package

Submodules

plaso.parsers.winreg_plugins.amcache module

Windows Registry plugin to parse the AMCache.hve Root key.

class plaso.parsers.winreg_plugins.amcache.AMCacheFileEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

AMCache file event data.

company_name

company name that created product file belongs to.

Type:

str

file_creation_time

file entry creation date and time.

Type:

dfdatetime.DateTimeValues

file_description

description of file.

Type:

str

file_modification_time

file entry last modification date and time.

Type:

dfdatetime.DateTimeValues

file_reference

file system file reference, for example 9-1 (MFT entry - sequence number).

Type:

str

file_size

size of file in bytes.

Type:

int

file_version

version of file.

Type:

str

full_path

full path of file.

Type:

str

installation_time

installation date and time.

Type:

dfdatetime.DateTimeValues

language_code

language code of file.

Type:

int

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

link date and time.

Type:

dfdatetime.DateTimeValues

msi_installation_time

MSI installation date and time.

Type:

dfdatetime.DateTimeValues

product_name

product name file belongs to.

Type:

str

program_identifier

GUID of entry under Root/Program key file belongs to.

Type:

str

sha1

SHA-1.

Type:

str

DATA_TYPE = 'windows:registry:amcache'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.amcache.AMCachePlugin[source]

Bases: WindowsRegistryPlugin

AMCache.hve Windows Registry plugin.

DATA_FORMAT = 'AMCache (AMCache.hve)'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'amcache'
class plaso.parsers.winreg_plugins.amcache.AMCacheProgramEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

AMCache programs event data.

entry_type

type of entry (usually AddRemoveProgram).

Type:

str

file_paths

file paths of installed program.

Type:

str

files

list of files belonging to program.

Type:

str

installation_time

installation date and time.

Type:

dfdatetime.DateTimeValues

language_code

language_code of program.

Type:

int

msi_package_code

MSI package code of program.

Type:

str

msi_product_code

MSI product code of program.

Type:

str

name

name of installed program.

Type:

str

package_code

package code of program.

Type:

str

product_code

product code of program.

Type:

str

publisher

publisher of program.

Type:

str

uninstall_key

unicode string of uninstall registry key for program.

Type:

str

version

version of program.

Type:

str

DATA_TYPE = 'windows:registry:amcache:programs'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.appcompatcache module

Windows Registry plugin to parse the Application Compatibility Cache key.

class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheCachedEntry[source]

Bases: object

Application Compatibility Cache cached entry.

__init__()[source]

Initializes the cached entry object.

class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Application Compatibility Cache event data.

entry_index

cache entry index number for the record.

Type:

int

file_entry_modification_time

last modification date and time of the corresponding file entry.

Type:

dfdatetime.DateTimeValues

key_path

Windows Registry key path.

Type:

str

last_update_time

last update date and time of the Application Compatibility Cache entry.

Type:

dfdatetime.DateTimeValues

offset

offset of the Application Compatibility Cache entry relative to the start of the Windows Registry value data, from which the event data was extracted.

Type:

int

path

full path to the executable.

Type:

str

DATA_TYPE = 'windows:registry:appcompatcache'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheHeader[source]

Bases: object

Application Compatibility Cache header.

__init__()[source]

Initializes the header object.

class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Application Compatibility Cache data Windows Registry plugin.

DATA_FORMAT = 'Application Compatibility Cache Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Raises:

ParseError – if the value data could not be parsed.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'appcompatcache'
__init__()[source]

Initializes a Application Compatibility Cache Registry plugin.

plaso.parsers.winreg_plugins.bagmru module

Windows Registry plugin to parse the BagMRU (or ShellBags) key.

class plaso.parsers.winreg_plugins.bagmru.BagMRUEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

BagMRU (or ShellBags) event data attribute container.

entries

most recently used (MRU) entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:bagmru'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.bagmru.BagMRUWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Windows Registry plugin to parse the BagMRU (or ShellBags) key.

DATA_FORMAT = 'BagMRU (or ShellBags) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'bagmru'

plaso.parsers.winreg_plugins.bam module

Windows Registry plugin to parse the Background Activity Moderator keys.

class plaso.parsers.winreg_plugins.bam.BackgroundActivityModeratorEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Background Activity Moderator event data.

last_run_time

executable (binary) last run date and time.

Type:

dfdatetime.DateTimeValues

path

path of the executable (binary).

Type:

str

user_identifier

user identifier (Windows NT SID).

Type:

str

DATA_TYPE = 'windows:registry:bam'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.bam.BackgroundActivityModeratorWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Background Activity Moderator data Windows Registry plugin.

DATA_FORMAT = 'Background Activity Moderator (BAM) Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Raises:

ParseError – if the value data could not be parsed.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'bam'

plaso.parsers.winreg_plugins.ccleaner module

Windows Registry plugin to parse the CCleaner Registry key.

Also see:

https://winreg-kb.readthedocs.io/en/latest/sources/application-keys/CCleaner.html

class plaso.parsers.winreg_plugins.ccleaner.CCleanerConfigurationEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

CCleaner configuration event data.

configuration

CCleaner configuration.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'ccleaner:configuration'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.ccleaner.CCleanerPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin to parse the CCleaner Registry key.

DATA_FORMAT = 'CCleaner Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'ccleaner'
class plaso.parsers.winreg_plugins.ccleaner.CCleanerUpdateEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

CCleaner update event data.

key_path

Windows Registry key path.

Type:

str

update_time

date and time CCleaner last checked for an update.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'ccleaner:update'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.default module

The default Windows Registry plugin.

class plaso.parsers.winreg_plugins.default.DefaultPlugin[source]

Bases: WindowsRegistryPlugin

Default plugin that extracts minimum information from every Registry key.

The default plugin will parse every Registry key that is passed to it and extract minimum information, such as a list of available values and if possible content of those values. The timestamp used is the timestamp when the Registry key was last modified.

DATA_FORMAT = 'Windows Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

NAME = 'winreg_default'

plaso.parsers.winreg_plugins.interface module

The Windows Registry plugin interface.

class plaso.parsers.winreg_plugins.interface.BaseWindowsRegistryKeyFilter[source]

Bases: object

The Windows Registry key filter interface.

abstract Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the keys match.

Return type:

bool

property key_paths

key paths defined by the filter.

Type:

List[str]

class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter(key_path)[source]

Bases: BaseWindowsRegistryKeyFilter

Windows Registry key path filter.

Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the keys match.

Return type:

bool

__init__(key_path)[source]

Initializes a Windows Registry key filter.

Parameters:

key_path (str) – key path.

property key_paths

List of key paths defined by the filter.

class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathPrefixFilter(key_path_prefix)[source]

Bases: BaseWindowsRegistryKeyFilter

Windows Registry key path prefix filter.

Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the keys match.

Return type:

bool

__init__(key_path_prefix)[source]

Initializes a Windows Registry key filter.

Parameters:

key_path_prefix (str) – the key path prefix.

class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathSuffixFilter(key_path_suffix)[source]

Bases: BaseWindowsRegistryKeyFilter

Windows Registry key path suffix filter.

Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the keys match.

Return type:

bool

__init__(key_path_suffix)[source]

Initializes a Windows Registry key filter.

Parameters:

key_path_suffix (str) – the key path suffix.

class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyWithValuesFilter(value_names)[source]

Bases: BaseWindowsRegistryKeyFilter

Windows Registry key with values filter.

Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the keys match.

Return type:

bool

__init__(value_names)[source]

Initializes a Windows Registry key filter.

Parameters:

value_names (list[str]) – name of values that should be present in the key.

class plaso.parsers.winreg_plugins.interface.WindowsRegistryPlugin[source]

Bases: BasePlugin

The Windows Registry plugin interface.

DATA_FORMAT = 'Windows Registry data'
abstract ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({})
NAME = 'winreg_plugin'
Process(parser_mediator, registry_key, **kwargs)[source]

Processes a Windows Registry key or value.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Raises:

ValueError – If the Windows Registry key is not set.

UpdateChainAndProcess(parser_mediator, registry_key, **kwargs)[source]

Updates the parser chain and processes a Windows Registry key or value.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Raises:

ValueError – If the Windows Registry key is not set.

plaso.parsers.winreg_plugins.lfu module

Plug-in to collect the Less Frequently Used (LFU) keys.

class plaso.parsers.winreg_plugins.lfu.BootExecutePlugin[source]

Bases: WindowsRegistryPlugin

Plug-in to collect the BootExecute Value from the Session Manager key.

DATA_FORMAT = 'Boot Execution Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_boot_execute'
class plaso.parsers.winreg_plugins.lfu.BootVerificationPlugin[source]

Bases: WindowsRegistryPlugin

Plug-in to collect the Boot Verification Key.

DATA_FORMAT = 'Windows boot verification Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_boot_verify'
class plaso.parsers.winreg_plugins.lfu.WindowsBootExecuteEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Boot Execute event data attribute container.

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

value

boot execute value, contains the value obtained from the BootExecute Registry value.

Type:

str

DATA_TYPE = 'windows:registry:boot_execute'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.lfu.WindowsBootVerificationEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Boot Verification event data attribute container.

image_path

location of the boot verification executable, contains the value obtained from the ImagePath Registry value.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:boot_verification'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.mountpoints module

MountPoints2 Windows Registry parser plugin.

class plaso.parsers.winreg_plugins.mountpoints.MountPoints2EventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows MountPoints2 event data attribute container.

key_path

Windows Registry key path.

Type:

str

label

mount point label.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

name

name of the mount point source.

Type:

str

server_name

name of the remote drive server or None if not set.

Type:

str

share_name

name of the remote drive share or None if not set.

Type:

str

type

type of the mount point source, which can be “Drive”, “Remove Drive” or “Volume”.

Type:

str

DATA_TYPE = 'windows:registry:mount_points2'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.mountpoints.MountPoints2Plugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for parsing the MountPoints2 key.

DATA_FORMAT = 'Windows Explorer mount points Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'explorer_mountpoints2'

plaso.parsers.winreg_plugins.mrulist module

Windows Registry plugin to parse the MRUList Registry values.

Also see:

https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

class plaso.parsers.winreg_plugins.mrulist.BaseMRUListWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Class for common MRUList Windows Registry plugin functionality.

class plaso.parsers.winreg_plugins.mrulist.MRUListEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MRUList event data attribute container.

entries

most recently used (MRU) entries.

Type:

list[str]

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:mrulist'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.mrulist.MRUListShellItemListWindowsRegistryPlugin[source]

Bases: BaseMRUListWindowsRegistryPlugin

Windows Registry plugin to parse a shell item list MRUList.

DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'mrulist_shell_item_list'
class plaso.parsers.winreg_plugins.mrulist.MRUListStringRegistryKeyFilter[source]

Bases: WindowsRegistryKeyWithValuesFilter

Windows Registry key with values filter.

Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the Windows Registry key matches the filter.

Return type:

bool

__init__()[source]

Initializes a Windows Registry key filter object.

class plaso.parsers.winreg_plugins.mrulist.MRUListStringWindowsRegistryPlugin[source]

Bases: BaseMRUListWindowsRegistryPlugin

Windows Registry plugin to parse a string MRUList.

DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.mrulist.MRUListStringRegistryKeyFilter object>})
NAME = 'mrulist_string'

plaso.parsers.winreg_plugins.mrulistex module

Windows Registry plugin to parse the MRUListEx Registry values.

Also see:

https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

class plaso.parsers.winreg_plugins.mrulistex.BaseMRUListExWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Class for common MRUListEx Windows Registry plugin functionality.

class plaso.parsers.winreg_plugins.mrulistex.MRUListExEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MRUListEx event data attribute container.

entries

most recently used (MRU) entries.

Type:

list[str]

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:mrulistex'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.mrulistex.MRUListExShellItemListWindowsRegistryPlugin[source]

Bases: BaseMRUListExWindowsRegistryPlugin

Windows Registry plugin to parse a shell item list MRUListEx.

DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'mrulistex_shell_item_list'
class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringAndShellItemListWindowsRegistryPlugin[source]

Bases: BaseMRUListExWindowsRegistryPlugin

Windows Registry plugin to parse a string and shell item list MRUListEx.

DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'mrulistex_string_and_shell_item_list'
class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringAndShellItemWindowsRegistryPlugin[source]

Bases: BaseMRUListExWindowsRegistryPlugin

Windows Registry plugin to parse a string and shell item MRUListEx.

DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'mrulistex_string_and_shell_item'
class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringRegistryKeyFilter[source]

Bases: WindowsRegistryKeyWithValuesFilter

Windows Registry key with values filter.

Match(registry_key)[source]

Determines if a Windows Registry key matches the filter.

Parameters:

registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

Returns:

True if the Windows Registry key matches the filter.

Return type:

bool

__init__()[source]

Initializes Windows Registry key filter object.

class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringWindowsRegistryPlugin[source]

Bases: BaseMRUListExWindowsRegistryPlugin

Windows Registry plugin to parse a string MRUListEx.

DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

  • codepage (Optional[str]) – extended ASCII string codepage.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.mrulistex.MRUListExStringRegistryKeyFilter object>})
NAME = 'mrulistex_string'

plaso.parsers.winreg_plugins.msie_zones module

This file contains the MSIE zone settings plugin.

class plaso.parsers.winreg_plugins.msie_zones.MSIEZoneSettingsEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

MSIE zone settings event data attribute container.

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

settings

MSIE zone settings.

Type:

str

DATA_TYPE = 'windows:registry:msie_zone_settings'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.msie_zones.MSIEZoneSettingsPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for parsing the MSIE zone settings.

The MSIE Feature controls are stored in the Zone specific subkeys in:

Internet SettingsZones key Internet SettingsLockdown_Zones key

DATA_FORMAT = 'Microsoft Internet Explorer zone settings Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'msie_zone'

plaso.parsers.winreg_plugins.network_drives module

This file contains the Network drive Registry plugin.

class plaso.parsers.winreg_plugins.network_drives.NetworkDriveEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Network drive event data attribute container.

drive_letter

drive letter assigned to network drive.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

server_name

name of the server of the network drive.

Type:

str

share_name

name of the share of the network drive.

Type:

str

DATA_TYPE = 'windows:registry:network_drive'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.network_drives.NetworkDrivesPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for parsing the Network key.

DATA_FORMAT = 'Windows network drives Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'network_drives'

plaso.parsers.winreg_plugins.networks module

This file contains the NetworkList Registry plugin.

class plaso.parsers.winreg_plugins.networks.NetworksWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Windows Registry plugin for parsing the NetworkList key.

DATA_FORMAT = 'Windows networks (NetworkList) Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'networks'
class plaso.parsers.winreg_plugins.networks.WindowsRegistryNetworkListEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows NetworkList event data.

connection_type

type of connection.

Type:

int

creation_time

entry creation date and time.

Type:

dfdatetime.DateTimeValues

default_gateway_mac

MAC address for the default gateway.

Type:

str

description

description of the wireless connection.

Type:

str

dns_suffix

DNS suffix.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_connected_time

last connected date and time.

Type:

dfdatetime.DateTimeValues

ssid

SSID of the connection.

Type:

str

DATA_TYPE = 'windows:registry:network'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.officemru module

Windows Registry plugin for the Microsoft Office MRU.

class plaso.parsers.winreg_plugins.officemru.OfficeMRUListWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Microsoft Office MRU list Windows Registry event data.

entries

most recently used (MRU) entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:office_mru_list'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.officemru.OfficeMRUPlugin[source]

Bases: WindowsRegistryPlugin

Plugin that parses Microsoft Office MRU keys.

DATA_FORMAT = 'Microsoft Office MRU Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'microsoft_office_mru'
class plaso.parsers.winreg_plugins.officemru.OfficeMRUWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Microsoft Office MRU Windows Registry event data.

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

value_string

MRU value.

Type:

str

DATA_TYPE = 'windows:registry:office_mru'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.outlook module

This file contains an Outlook search MRU Registry parser.

class plaso.parsers.winreg_plugins.outlook.OutlookSearchMRUEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Outlook search MRU event data attribute container.

entries

most recently used (MRU) entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:outlook_search_mru'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.outlook.OutlookSearchMRUPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin parsing Outlook Search MRU keys.

DATA_FORMAT = 'Microsoft Outlook search MRU Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'microsoft_outlook_mru'

plaso.parsers.winreg_plugins.programscache module

Windows Registry plugin to parse the Explorer ProgramsCache key.

class plaso.parsers.winreg_plugins.programscache.ExplorerProgramsCacheEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Explorer ProgramsCache event data attribute container.

entries

entries in the program cache.

Type:

str

key_path

Windows Registry key path.

Type:

str

known_folder_identifier

known folder identifier.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

value_name

Windows Registry value name.

Type:

str

DATA_TYPE = 'windows:registry:explorer:programcache'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.programscache.ExplorerProgramsCacheWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Class that parses the Explorer ProgramsCache Registry data.

DATA_FORMAT = 'Windows Explorer Programs Cache Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'explorer_programscache'

plaso.parsers.winreg_plugins.run module

This file contains the Run/RunOnce key plugins for Plaso.

class plaso.parsers.winreg_plugins.run.AutoRunsPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for parsing user specific auto runs.

DATA_FORMAT = 'Run and run once Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_run'
class plaso.parsers.winreg_plugins.run.RunKeyEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Run/RunOnce key event data attribute container.

entries

Run/RunOnce entries.

Type:

list[str]

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:run'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.sam_users module

“Windows Registry plugin for SAM Users Account information.

class plaso.parsers.winreg_plugins.sam_users.SAMUsersWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Class that defines SAM users Windows Registry event data.

account_rid

account relative identifier (RID).

Type:

int

comments

comments.

Type:

str

fullname

full name.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_login_time

date and time of the last login.

Type:

dfdatetime.DateTimeValues

last_password_set_time

date and time of the last password set.

Type:

dfdatetime.DateTimeValues

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

login_count

login count.

Type:

int

username

a string containing the username.

Type:

str

DATA_TYPE = 'windows:registry:sam_users'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.sam_users.SAMUsersWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Windows Registry plugin for SAM Users Account information.

DATA_FORMAT = 'Security Accounts Manager (SAM) users Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_sam_users'

plaso.parsers.winreg_plugins.services module

Windows drivers and services Registry key parser plugin.

class plaso.parsers.winreg_plugins.services.ServicesPlugin[source]

Bases: WindowsRegistryPlugin

Plug-in to format the Services and Drivers keys having Type and Start.

DATA_FORMAT = 'Windows drivers and services Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyWithValuesFilter object>})
NAME = 'windows_services'
class plaso.parsers.winreg_plugins.services.WindowsRegistryServiceEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows Registry driver or service event data attribute container.

error_control

error control value of the Windows driver or service executable.

Type:

int

image_path

path of the Windows driver or service executable.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

name

name of the Windows driver or service.

Type:

str

object_name

Windows service object name.

Type:

str

service_dll

Windows service DLL.

Type:

str

service_type

Windows driver or service type.

Type:

int

start_type

Device or service start type.

Type:

int

values

names and data of additional values in the key.

Type:

str

values

name, data type and data of the additional values in the key.

Type:

list[tuple[str, str, str]]

DATA_TYPE = 'windows:registry:service'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.shutdown module

Windows Registry plugin for parsing the last shutdown time of a system.

class plaso.parsers.winreg_plugins.shutdown.ShutdownWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Shutdown Windows Registry event data.

key_path

Windows Registry key path.

Type:

str

last_shutdown_time

date and time the system was last shutdown.

Type:

dfdatetime.DateTimeValues

value_name

name of the Windows Registry value.

Type:

str

DATA_TYPE = 'windows:registry:shutdown'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.shutdown.ShutdownWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Windows Registry plugin for parsing the last shutdown time of a system.

DATA_FORMAT = 'Windows last shutdown Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a ShutdownTime Windows Registry value.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_shutdown'

plaso.parsers.winreg_plugins.task_scheduler module

This file contains the Task Scheduler Registry keys plugins.

class plaso.parsers.winreg_plugins.task_scheduler.TaskCacheEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Task Cache event data.

key_path

Windows Registry key path.

Type:

str

last_registered_time

date and time the task was last registered.

Type:

dfdatetime.DateTimeValues

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

launch_time

date and time the task was last launched.

Type:

dfdatetime.DateTimeValues

task_name

name of the task.

Type:

str

task_identifier

identifier of the task.

Type:

str

unknown_time

unknown date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'task_scheduler:task_cache:entry'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.task_scheduler.TaskCacheWindowsRegistryPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Plugin that parses a Task Cache key.

DATA_FORMAT = 'Windows Task Scheduler cache Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_task_cache'

plaso.parsers.winreg_plugins.terminal_server module

This file contains the Terminal Server client Windows Registry plugins.

class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientConnectionEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Terminal Server client connection event data attribute container.

entries

most recently used (MRU) entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

username

username, provided by the UsernameHint value.

Type:

str

DATA_TYPE = 'windows:registry:mstsc:connection'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientMRUEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Terminal Server client MRU event data attribute container.

entries

most recently used (MRU) entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:mstsc:mru'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientMRUPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for Terminal Server Client Connection MRU keys.

DATA_FORMAT = 'Terminal Server Client Most Recently Used (MRU) Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Terminal Server Client MRU Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'mstsc_rdp_mru'
class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for Terminal Server Client Connection keys.

DATA_FORMAT = 'Terminal Server Client Connection Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Terminal Server Client Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'mstsc_rdp'

plaso.parsers.winreg_plugins.timezone module

Plug-in to collect information about the Windows timezone settings.

class plaso.parsers.winreg_plugins.timezone.WinRegTimezonePlugin[source]

Bases: WindowsRegistryPlugin

Plug-in to collect information about the Windows timezone settings.

DATA_FORMAT = 'Windows time zone Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_timezone'
class plaso.parsers.winreg_plugins.timezone.WindowsTimezoneSettingsEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Timezone settings event data attribute container.

configuration

timezone configuration.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:timezone'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.typedurls module

File containing a Windows Registry plugin to parse the typed URLs key.

class plaso.parsers.winreg_plugins.typedurls.TypedURLsEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Typed URLs event data attribute container.

entries

typed URLs or paths entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'windows:registry:typedurls'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.typedurls.TypedURLsPlugin[source]

Bases: WindowsRegistryPlugin

A Windows Registry plugin for typed URLs history.

DATA_FORMAT = 'Windows Explorer typed URLs Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_typed_urls'

plaso.parsers.winreg_plugins.usb module

File containing a Windows Registry plugin to parse the USB Device key.

Also see:

https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/

class plaso.parsers.winreg_plugins.usb.USBPlugin[source]

Bases: WindowsRegistryPlugin

USB Windows Registry plugin for last connection time.

DATA_FORMAT = 'Windows USB device Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_usb_devices'
class plaso.parsers.winreg_plugins.usb.WindowsUSBDeviceEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows USB device event data attribute container.

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

product

product of the USB device.

Type:

str

serial

serial number of the USB device.

Type:

str

subkey_name

name of the Windows Registry subkey.

Type:

str

vendor

vendor of the USB device.

Type:

str

DATA_TYPE = 'windows:registry:usb'
__init__()[source]

Initializes event data.

plaso.parsers.winreg_plugins.usbstor module

File containing a Windows Registry plugin to parse the USBStor key.

Also see:

https://forensics.wiki/usb_history_viewing

class plaso.parsers.winreg_plugins.usbstor.USBStorDeviceInstanceEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

USBStor device instance event data attribute container.

device_last_arrival_time

date and time of the device insertion.

Type:

dfdatetime.DateTimeValues

device_last_removal_time

date and time of the removal insertion.

Type:

dfdatetime.DateTimeValues

device_type

type of USB device.

Type:

str

display_name

display name of the USB device.

Type:

str

key_path

Windows Registry key path.

Type:

str

driver_first_installation_time

date and time of when the device instance was first installed in the system

Type:

dfdatetime.DateTimeValues

driver_last_installation_time

date and time of when the current device instance was installed in the system.

Type:

dfdatetime.DateTimeValues

firmware_time

date and time of the firmware.

Type:

dfdatetime.DateTimeValues

product

product of the USB device.

Type:

str

revision

revision number of the USB device.

Type:

str

vendor

vendor of the USB device.

Type:

str

DATA_TYPE = 'windows:registry:usbstor:instance'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.usbstor.USBStorPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

USBStor key plugin.

DATA_FORMAT = 'Windows USB Plug And Play Manager USBStor Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_usbstor_devices'

plaso.parsers.winreg_plugins.userassist module

The UserAssist Windows Registry plugin.

class plaso.parsers.winreg_plugins.userassist.UserAssistPlugin[source]

Bases: WindowsRegistryPlugin, DtFabricHelper

Plugin that parses an UserAssist key.

DATA_FORMAT = 'User Assist Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>})
NAME = 'userassist'
class plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

UserAssist Windows Registry event data.

application_focus_count

application focus count.

Type:

int

application_focus_duration

application focus duration.

Type:

int

entry_index

entry index.

Type:

int

key_path

Windows Registry key path.

Type:

str

last_execution_time

date and time the application was last executed (or run).

Type:

dfdatetime.DateTimeValues

number_of_executions

number of executions.

Type:

int

value_name

name of the Windows Registry value.

Type:

str

DATA_TYPE = 'windows:registry:userassist'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter(user_assist_guid)[source]

Bases: WindowsRegistryKeyPathFilter

UserAssist Windows Registry key path filter.

__init__(user_assist_guid)[source]

Initializes Windows Registry key filter.

Parameters:

user_assist_guid (str) – UserAssist GUID.

plaso.parsers.winreg_plugins.windows_version module

Plug-in to collect information about the Windows version.

class plaso.parsers.winreg_plugins.windows_version.WindowsRegistryInstallationEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Windows installation event data attribute container.

build_number

Windows build number.

Type:

str

installation_time

Windows installation date and time.

Type:

dfdatetime.DateTimeValues

key_path

Windows Registry key path.

Type:

str

owner

registered owner.

Type:

str

product_name

product name.

Type:

str

service_pack

service pack.

Type:

str

version

Windows version.

Type:

str

DATA_TYPE = 'windows:registry:installation'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.windows_version.WindowsVersionPlugin[source]

Bases: WindowsRegistryPlugin

Plug-in to collect information about the Windows version.

DATA_FORMAT = 'Windows version (product) Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'windows_version'

plaso.parsers.winreg_plugins.winlogon module

This file contains the Winlogon Registry plugin.

class plaso.parsers.winreg_plugins.winlogon.WinlogonEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Winlogon event data attribute container.

application

Winlogon application.

Type:

str

command

Winlogon command.

Type:

str

handler

Winlogon handler.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

trigger

Winlogon trigger.

Type:

str

DATA_TYPE = 'windows:registry:winlogon'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.winlogon.WinlogonPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for parsing the Winlogon key.

DATA_FORMAT = 'Windows log-on Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'winlogon'

plaso.parsers.winreg_plugins.winrar module

This file contains a WinRAR history Windows Registry plugin.

class plaso.parsers.winreg_plugins.winrar.WinRARHistoryEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

WinRAR history event data attribute container.

entries

archive history entries.

Type:

str

key_path

Windows Registry key path.

Type:

str

last_written_time

entry last written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'winrar:history'
__init__()[source]

Initializes event data.

class plaso.parsers.winreg_plugins.winrar.WinRARHistoryPlugin[source]

Bases: WindowsRegistryPlugin

Windows Registry plugin for parsing WinRAR History keys.

DATA_FORMAT = 'WinRAR History Registry data'
ExtractEvents(parser_mediator, registry_key, **kwargs)[source]

Extracts events from a Windows Registry key.

Parameters:
  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.

FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
NAME = 'winrar_mru'

Module contents

Imports for the Windows Registry parser.