plaso.parsers.winreg_plugins package
Submodules
plaso.parsers.winreg_plugins.amcache module
Windows Registry plugin to parse the AMCache.hve Root key.
- class plaso.parsers.winreg_plugins.amcache.AMCacheFileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
AMCache file event data.
- company_name
company name that created product file belongs to.
- Type
str
- file_creation_time
file entry creation date and time.
- Type
dfdatetime.DateTimeValues
- file_description
description of file.
- Type
str
- file_modification_time
file entry last modification date and time.
- Type
dfdatetime.DateTimeValues
- file_reference
file system file reference, for example 9-1 (MFT entry - sequence number).
- Type
str
- file_size
size of file in bytes.
- Type
int
- file_version
version of file.
- Type
str
- full_path
full path of file.
- Type
str
- installation_time
installation date and time.
- Type
dfdatetime.DateTimeValues
- language_code
language code of file.
- Type
int
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- link_time
link date and time.
- Type
dfdatetime.DateTimeValues
- msi_installation_time
MSI installation date and time.
- Type
dfdatetime.DateTimeValues
- product_name
product name file belongs to.
- Type
str
- program_identifier
GUID of entry under Root/Program key file belongs to.
- Type
str
- sha1
SHA-1.
- Type
str
- DATA_TYPE = 'windows:registry:amcache'
- class plaso.parsers.winreg_plugins.amcache.AMCachePlugin[source]
Bases:
WindowsRegistryPlugin
AMCache.hve Windows Registry plugin.
- DATA_FORMAT = 'AMCache (AMCache.hve)'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'amcache'
- class plaso.parsers.winreg_plugins.amcache.AMCacheProgramEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
AMCache programs event data.
- entry_type
type of entry (usually AddRemoveProgram).
- Type
str
- file_paths
file paths of installed program.
- Type
str
- files
list of files belonging to program.
- Type
str
- installation_time
installation date and time.
- Type
dfdatetime.DateTimeValues
- language_code
language_code of program.
- Type
int
- msi_package_code
MSI package code of program.
- Type
str
- msi_product_code
MSI product code of program.
- Type
str
- name
name of installed program.
- Type
str
- package_code
package code of program.
- Type
str
- product_code
product code of program.
- Type
str
- publisher
publisher of program.
- Type
str
- uninstall_key
unicode string of uninstall registry key for program.
- Type
str
- version
version of program.
- Type
str
- DATA_TYPE = 'windows:registry:amcache:programs'
plaso.parsers.winreg_plugins.appcompatcache module
Windows Registry plugin to parse the Application Compatibility Cache key.
- class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheCachedEntry[source]
Bases:
object
Application Compatibility Cache cached entry.
- class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Application Compatibility Cache event data.
- entry_index
cache entry index number for the record.
- Type
int
- file_entry_modification_time
last modification date and time of the corresponding file entry.
- Type
dfdatetime.DateTimeValues
- key_path
Windows Registry key path.
- Type
str
- last_update_time
last update date and time of the Application Compatibility Cache entry.
- Type
dfdatetime.DateTimeValues
- offset
offset of the Application Compatibility Cache entry relative to the start of the Windows Registry value data, from which the event data was extracted.
- Type
int
- path
full path to the executable.
- Type
str
- DATA_TYPE = 'windows:registry:appcompatcache'
- class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheHeader[source]
Bases:
object
Application Compatibility Cache header.
- class plaso.parsers.winreg_plugins.appcompatcache.AppCompatCacheWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Application Compatibility Cache data Windows Registry plugin.
- DATA_FORMAT = 'Application Compatibility Cache Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- Raises
ParseError – if the value data could not be parsed.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'appcompatcache'
plaso.parsers.winreg_plugins.bagmru module
Windows Registry plugin to parse the BagMRU (or ShellBags) key.
- class plaso.parsers.winreg_plugins.bagmru.BagMRUEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
BagMRU (or ShellBags) event data attribute container.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:bagmru'
- class plaso.parsers.winreg_plugins.bagmru.BagMRUWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Windows Registry plugin to parse the BagMRU (or ShellBags) key.
- DATA_FORMAT = 'BagMRU (or ShellBags) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'bagmru'
plaso.parsers.winreg_plugins.bam module
Windows Registry plugin to parse the Background Activity Moderator keys.
- class plaso.parsers.winreg_plugins.bam.BackgroundActivityModeratorEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Background Activity Moderator event data.
- last_run_time
executable (binary) last run date and time.
- Type
dfdatetime.DateTimeValues
- path
path of the executable (binary).
- Type
str
- user_identifier
user identifier (Windows NT SID).
- Type
str
- DATA_TYPE = 'windows:registry:bam'
- class plaso.parsers.winreg_plugins.bam.BackgroundActivityModeratorWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Background Activity Moderator data Windows Registry plugin.
- DATA_FORMAT = 'Background Activity Moderator (BAM) Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- Raises
ParseError – if the value data could not be parsed.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'bam'
plaso.parsers.winreg_plugins.ccleaner module
Windows Registry plugin to parse the CCleaner Registry key.
- class plaso.parsers.winreg_plugins.ccleaner.CCleanerConfigurationEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
CCleaner configuration event data.
- configuration
CCleaner configuration.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'ccleaner:configuration'
- class plaso.parsers.winreg_plugins.ccleaner.CCleanerPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin to parse the CCleaner Registry key.
- DATA_FORMAT = 'CCleaner Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'ccleaner'
- class plaso.parsers.winreg_plugins.ccleaner.CCleanerUpdateEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
CCleaner update event data.
- key_path
Windows Registry key path.
- Type
str
- update_time
date and time CCleaner last checked for an update.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'ccleaner:update'
plaso.parsers.winreg_plugins.default module
The default Windows Registry plugin.
- class plaso.parsers.winreg_plugins.default.DefaultPlugin[source]
Bases:
WindowsRegistryPlugin
Default plugin that extracts minimum information from every Registry key.
The default plugin will parse every Registry key that is passed to it and extract minimum information, such as a list of available values and if possible content of those values. The timestamp used is the timestamp when the Registry key was last modified.
- DATA_FORMAT = 'Windows Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- NAME = 'winreg_default'
plaso.parsers.winreg_plugins.interface module
The Windows Registry plugin interface.
- class plaso.parsers.winreg_plugins.interface.BaseWindowsRegistryKeyFilter[source]
Bases:
object
The Windows Registry key filter interface.
- abstract Match(registry_key)[source]
Determines if a Windows Registry key matches the filter.
- Parameters
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- Returns
True if the keys match.
- Return type
bool
- property key_paths
key paths defined by the filter.
- Type
list[str]
- class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter(key_path)[source]
Bases:
BaseWindowsRegistryKeyFilter
Windows Registry key path filter.
- Match(registry_key)[source]
Determines if a Windows Registry key matches the filter.
- Parameters
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- Returns
True if the keys match.
- Return type
bool
- property key_paths
List of key paths defined by the filter.
- class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathPrefixFilter(key_path_prefix)[source]
Bases:
BaseWindowsRegistryKeyFilter
Windows Registry key path prefix filter.
- class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathSuffixFilter(key_path_suffix)[source]
Bases:
BaseWindowsRegistryKeyFilter
Windows Registry key path suffix filter.
- class plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyWithValuesFilter(value_names)[source]
Bases:
BaseWindowsRegistryKeyFilter
Windows Registry key with values filter.
- class plaso.parsers.winreg_plugins.interface.WindowsRegistryPlugin[source]
Bases:
BasePlugin
The Windows Registry plugin interface.
- DATA_FORMAT = 'Windows Registry data'
- abstract ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({})
- NAME = 'winreg_plugin'
- Process(parser_mediator, registry_key, **kwargs)[source]
Processes a Windows Registry key or value.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- Raises
ValueError – If the Windows Registry key is not set.
- UpdateChainAndProcess(parser_mediator, registry_key, **kwargs)[source]
Updates the parser chain and processes a Windows Registry key or value.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- Raises
ValueError – If the Windows Registry key is not set.
plaso.parsers.winreg_plugins.lfu module
Plug-in to collect the Less Frequently Used (LFU) keys.
- class plaso.parsers.winreg_plugins.lfu.BootExecutePlugin[source]
Bases:
WindowsRegistryPlugin
Plug-in to collect the BootExecute Value from the Session Manager key.
- DATA_FORMAT = 'Boot Execution Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_boot_execute'
- class plaso.parsers.winreg_plugins.lfu.BootVerificationPlugin[source]
Bases:
WindowsRegistryPlugin
Plug-in to collect the Boot Verification Key.
- DATA_FORMAT = 'Windows boot verification Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_boot_verify'
- class plaso.parsers.winreg_plugins.lfu.WindowsBootExecuteEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Boot Execute event data attribute container.
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- value
boot execute value, contains the value obtained from the BootExecute Registry value.
- Type
str
- DATA_TYPE = 'windows:registry:boot_execute'
- class plaso.parsers.winreg_plugins.lfu.WindowsBootVerificationEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Boot Verification event data attribute container.
- image_path
location of the boot verification executable, contains the value obtained from the ImagePath Registry value.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:boot_verification'
plaso.parsers.winreg_plugins.mountpoints module
MountPoints2 Windows Registry parser plugin.
- class plaso.parsers.winreg_plugins.mountpoints.MountPoints2EventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows MountPoints2 event data attribute container.
- key_path
Windows Registry key path.
- Type
str
- label
mount point label.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- name
name of the mount point source.
- Type
str
- server_name
name of the remote drive server or None if not set.
- Type
str
name of the remote drive share or None if not set.
- Type
str
- type
type of the mount point source, which can be “Drive”, “Remove Drive” or “Volume”.
- Type
str
- DATA_TYPE = 'windows:registry:mount_points2'
- class plaso.parsers.winreg_plugins.mountpoints.MountPoints2Plugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for parsing the MountPoints2 key.
- DATA_FORMAT = 'Windows Explorer mount points Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'explorer_mountpoints2'
plaso.parsers.winreg_plugins.mrulist module
Windows Registry plugin to parse the MRUList Registry values.
- class plaso.parsers.winreg_plugins.mrulist.BaseMRUListWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Class for common MRUList Windows Registry plugin functionality.
- class plaso.parsers.winreg_plugins.mrulist.MRUListEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MRUList event data attribute container.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:mrulist'
- class plaso.parsers.winreg_plugins.mrulist.MRUListShellItemListWindowsRegistryPlugin[source]
Bases:
BaseMRUListWindowsRegistryPlugin
Windows Registry plugin to parse a shell item list MRUList.
- DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'mrulist_shell_item_list'
- class plaso.parsers.winreg_plugins.mrulist.MRUListStringRegistryKeyFilter[source]
Bases:
WindowsRegistryKeyWithValuesFilter
Windows Registry key with values filter.
- class plaso.parsers.winreg_plugins.mrulist.MRUListStringWindowsRegistryPlugin[source]
Bases:
BaseMRUListWindowsRegistryPlugin
Windows Registry plugin to parse a string MRUList.
- DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.mrulist.MRUListStringRegistryKeyFilter object>})
- NAME = 'mrulist_string'
plaso.parsers.winreg_plugins.mrulistex module
Windows Registry plugin to parse the MRUListEx Registry values.
- class plaso.parsers.winreg_plugins.mrulistex.BaseMRUListExWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Class for common MRUListEx Windows Registry plugin functionality.
- class plaso.parsers.winreg_plugins.mrulistex.MRUListExEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MRUListEx event data attribute container.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:mrulistex'
- class plaso.parsers.winreg_plugins.mrulistex.MRUListExShellItemListWindowsRegistryPlugin[source]
Bases:
BaseMRUListExWindowsRegistryPlugin
Windows Registry plugin to parse a shell item list MRUListEx.
- DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'mrulistex_shell_item_list'
- class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringAndShellItemListWindowsRegistryPlugin[source]
Bases:
BaseMRUListExWindowsRegistryPlugin
Windows Registry plugin to parse a string and shell item list MRUListEx.
- DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'mrulistex_string_and_shell_item_list'
- class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringAndShellItemWindowsRegistryPlugin[source]
Bases:
BaseMRUListExWindowsRegistryPlugin
Windows Registry plugin to parse a string and shell item MRUListEx.
- DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'mrulistex_string_and_shell_item'
- class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringRegistryKeyFilter[source]
Bases:
WindowsRegistryKeyWithValuesFilter
Windows Registry key with values filter.
- class plaso.parsers.winreg_plugins.mrulistex.MRUListExStringWindowsRegistryPlugin[source]
Bases:
BaseMRUListExWindowsRegistryPlugin
Windows Registry plugin to parse a string MRUListEx.
- DATA_FORMAT = 'Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, codepage='cp1252', **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
codepage (Optional[str]) – extended ASCII string codepage.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.mrulistex.MRUListExStringRegistryKeyFilter object>})
- NAME = 'mrulistex_string'
plaso.parsers.winreg_plugins.msie_zones module
This file contains the MSIE zone settings plugin.
- class plaso.parsers.winreg_plugins.msie_zones.MSIEZoneSettingsEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIE zone settings event data attribute container.
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- settings
MSIE zone settings.
- Type
str
- DATA_TYPE = 'windows:registry:msie_zone_settings'
- class plaso.parsers.winreg_plugins.msie_zones.MSIEZoneSettingsPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for parsing the MSIE zone settings.
- The MSIE Feature controls are stored in the Zone specific subkeys in:
Internet SettingsZones key Internet SettingsLockdown_Zones key
- DATA_FORMAT = 'Microsoft Internet Explorer zone settings Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'msie_zone'
plaso.parsers.winreg_plugins.network_drives module
This file contains the Network drive Registry plugin.
- class plaso.parsers.winreg_plugins.network_drives.NetworkDriveEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Network drive event data attribute container.
- drive_letter
drive letter assigned to network drive.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- server_name
name of the server of the network drive.
- Type
str
name of the share of the network drive.
- Type
str
- DATA_TYPE = 'windows:registry:network_drive'
- class plaso.parsers.winreg_plugins.network_drives.NetworkDrivesPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for parsing the Network key.
- DATA_FORMAT = 'Windows network drives Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'network_drives'
plaso.parsers.winreg_plugins.networks module
This file contains the NetworkList Registry plugin.
- class plaso.parsers.winreg_plugins.networks.NetworksWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Windows Registry plugin for parsing the NetworkList key.
- DATA_FORMAT = 'Windows networks (NetworkList) Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'networks'
- class plaso.parsers.winreg_plugins.networks.WindowsRegistryNetworkListEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows NetworkList event data.
- connection_type
type of connection.
- Type
int
- creation_time
entry creation date and time.
- Type
dfdatetime.DateTimeValues
- default_gateway_mac
MAC address for the default gateway.
- Type
str
- description
description of the wireless connection.
- Type
str
- dns_suffix
DNS suffix.
- Type
str
- last_connected_time
last connected date and time.
- Type
dfdatetime.DateTimeValues
- ssid
SSID of the connection.
- Type
str
- DATA_TYPE = 'windows:registry:network'
plaso.parsers.winreg_plugins.officemru module
Windows Registry plugin for the Microsoft Office MRU.
- class plaso.parsers.winreg_plugins.officemru.OfficeMRUListWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Microsoft Office MRU list Windows Registry event data.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:office_mru_list'
- class plaso.parsers.winreg_plugins.officemru.OfficeMRUPlugin[source]
Bases:
WindowsRegistryPlugin
Plugin that parses Microsoft Office MRU keys.
- DATA_FORMAT = 'Microsoft Office MRU Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'microsoft_office_mru'
- class plaso.parsers.winreg_plugins.officemru.OfficeMRUWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Microsoft Office MRU Windows Registry event data.
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- value_string
MRU value.
- Type
str
- DATA_TYPE = 'windows:registry:office_mru'
plaso.parsers.winreg_plugins.outlook module
This file contains an Outlook search MRU Registry parser.
- class plaso.parsers.winreg_plugins.outlook.OutlookSearchMRUEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Outlook search MRU event data attribute container.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:outlook_search_mru'
- class plaso.parsers.winreg_plugins.outlook.OutlookSearchMRUPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin parsing Outlook Search MRU keys.
- DATA_FORMAT = 'Microsoft Outlook search MRU Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'microsoft_outlook_mru'
plaso.parsers.winreg_plugins.programscache module
Windows Registry plugin to parse the Explorer ProgramsCache key.
- class plaso.parsers.winreg_plugins.programscache.ExplorerProgramsCacheEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Explorer ProgramsCache event data attribute container.
- entries
entries in the program cache.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- known_folder_identifier
known folder identifier.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- value_name
Windows Registry value name.
- Type
str
- DATA_TYPE = 'windows:registry:explorer:programcache'
- class plaso.parsers.winreg_plugins.programscache.ExplorerProgramsCacheWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Class that parses the Explorer ProgramsCache Registry data.
- DATA_FORMAT = 'Windows Explorer Programs Cache Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'explorer_programscache'
plaso.parsers.winreg_plugins.run module
This file contains the Run/RunOnce key plugins for Plaso.
- class plaso.parsers.winreg_plugins.run.AutoRunsPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for parsing user specific auto runs.
- DATA_FORMAT = 'Run and run once Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_run'
- class plaso.parsers.winreg_plugins.run.RunKeyEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Run/RunOnce key event data attribute container.
- entries
Run/RunOnce entries.
- Type
list[str]
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:run'
plaso.parsers.winreg_plugins.sam_users module
“Windows Registry plugin for SAM Users Account information.
- class plaso.parsers.winreg_plugins.sam_users.SAMUsersWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Class that defines SAM users Windows Registry event data.
- account_rid
account relative identifier (RID).
- Type
int
- comments
comments.
- Type
str
- fullname
full name.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_login_time
date and time of the last login.
- Type
dfdatetime.DateTimeValues
- last_password_set_time
date and time of the last password set.
- Type
dfdatetime.DateTimeValues
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- login_count
login count.
- Type
int
- username
a string containing the username.
- Type
str
- DATA_TYPE = 'windows:registry:sam_users'
- class plaso.parsers.winreg_plugins.sam_users.SAMUsersWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Windows Registry plugin for SAM Users Account information.
- DATA_FORMAT = 'Security Accounts Manager (SAM) users Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_sam_users'
plaso.parsers.winreg_plugins.services module
Windows drivers and services Registry key parser plugin.
- class plaso.parsers.winreg_plugins.services.ServicesPlugin[source]
Bases:
WindowsRegistryPlugin
Plug-in to format the Services and Drivers keys having Type and Start.
- DATA_FORMAT = 'Windows drivers and services Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyWithValuesFilter object>})
- NAME = 'windows_services'
- class plaso.parsers.winreg_plugins.services.WindowsRegistryServiceEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Registry driver or service event data attribute container.
- error_control
error control value of the Windows driver or service executable.
- Type
int
- image_path
path of the Windows driver or service executable.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- name
name of the Windows driver or service.
- Type
str
- object_name
Windows service object name.
- Type
str
- service_dll
Windows service DLL.
- Type
str
- service_type
Windows driver or service type.
- Type
int
- start_type
Device or service start type.
- Type
int
- values
names and data of additional values in the key.
- Type
str
- values
name, data type and data of the additional values in the key.
- Type
list[tuple[str, str, str]]
- DATA_TYPE = 'windows:registry:service'
plaso.parsers.winreg_plugins.shutdown module
Windows Registry plugin for parsing the last shutdown time of a system.
- class plaso.parsers.winreg_plugins.shutdown.ShutdownWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Shutdown Windows Registry event data.
- key_path
Windows Registry key path.
- Type
str
- last_shutdown_time
date and time the system was last shutdown.
- Type
dfdatetime.DateTimeValues
- value_name
name of the Windows Registry value.
- Type
str
- DATA_TYPE = 'windows:registry:shutdown'
- class plaso.parsers.winreg_plugins.shutdown.ShutdownWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Windows Registry plugin for parsing the last shutdown time of a system.
- DATA_FORMAT = 'Windows last shutdown Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a ShutdownTime Windows Registry value.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_shutdown'
plaso.parsers.winreg_plugins.task_scheduler module
This file contains the Task Scheduler Registry keys plugins.
- class plaso.parsers.winreg_plugins.task_scheduler.TaskCacheEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Task Cache event data.
- key_path
Windows Registry key path.
- Type
str
- last_registered_time
date and time the task was last registered.
- Type
dfdatetime.DateTimeValues
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- launch_time
date and time the task was last launched.
- Type
dfdatetime.DateTimeValues
- task_name
name of the task.
- Type
str
- task_identifier
identifier of the task.
- Type
str
- unknown_time
unknown date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'task_scheduler:task_cache:entry'
- class plaso.parsers.winreg_plugins.task_scheduler.TaskCacheWindowsRegistryPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Plugin that parses a Task Cache key.
- DATA_FORMAT = 'Windows Task Scheduler cache Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_task_cache'
plaso.parsers.winreg_plugins.terminal_server module
This file contains the Terminal Server client Windows Registry plugins.
- class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientConnectionEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Terminal Server client connection event data attribute container.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- username
username, provided by the UsernameHint value.
- Type
str
- DATA_TYPE = 'windows:registry:mstsc:connection'
- class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientMRUEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Terminal Server client MRU event data attribute container.
- entries
most recently used (MRU) entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:mstsc:mru'
- class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientMRUPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for Terminal Server Client Connection MRUs keys.
- DATA_FORMAT = 'Terminal Server Client Most Recently Used (MRU) Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Terminal Server Client MRU Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'mstsc_rdp_mru'
- class plaso.parsers.winreg_plugins.terminal_server.TerminalServerClientPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for Terminal Server Client Connection keys.
- DATA_FORMAT = 'Terminal Server Client Connection Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Terminal Server Client Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'mstsc_rdp'
plaso.parsers.winreg_plugins.timezone module
Plug-in to collect information about the Windows timezone settings.
- class plaso.parsers.winreg_plugins.timezone.WinRegTimezonePlugin[source]
Bases:
WindowsRegistryPlugin
Plug-in to collect information about the Windows timezone settings.
- DATA_FORMAT = 'Windows time zone Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_timezone'
- class plaso.parsers.winreg_plugins.timezone.WindowsTimezoneSettingsEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Timezone settings event data attribute container.
- configuration
timezone configuration.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:timezone'
plaso.parsers.winreg_plugins.typedurls module
File containing a Windows Registry plugin to parse the typed URLs key.
- class plaso.parsers.winreg_plugins.typedurls.TypedURLsEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Typed URLs event data attribute container.
- entries
typed URLs or paths entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:registry:typedurls'
- class plaso.parsers.winreg_plugins.typedurls.TypedURLsPlugin[source]
Bases:
WindowsRegistryPlugin
A Windows Registry plugin for typed URLs history.
- DATA_FORMAT = 'Windows Explorer typed URLs Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_typed_urls'
plaso.parsers.winreg_plugins.usb module
File containing a Windows Registry plugin to parse the USB Device key.
- class plaso.parsers.winreg_plugins.usb.USBPlugin[source]
Bases:
WindowsRegistryPlugin
USB Windows Registry plugin for last connection time.
- DATA_FORMAT = 'Windows USB device Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_usb_devices'
- class plaso.parsers.winreg_plugins.usb.WindowsUSBDeviceEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows USB device event data attribute container.
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- product
product of the USB device.
- Type
str
- serial
serial number of the USB device.
- Type
str
- subkey_name
name of the Windows Registry subkey.
- Type
str
- vendor
vendor of the USB device.
- Type
str
- DATA_TYPE = 'windows:registry:usb'
plaso.parsers.winreg_plugins.usbstor module
File containing a Windows Registry plugin to parse the USBStor key.
- class plaso.parsers.winreg_plugins.usbstor.USBStorDeviceInstanceEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
USBStor device instance event data attribute container.
- device_last_arrival_time
date and time of the device insertion.
- Type
dfdatetime.DateTimeValues
- device_last_removal_time
date and time of the removal insertion.
- Type
dfdatetime.DateTimeValues
- device_type
type of USB device.
- Type
str
- display_name
display name of the USB device.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- driver_first_installation_time
date and time of when the device instance was first installed in the system
- Type
dfdatetime.DateTimeValues
- driver_last_installation_time
date and time of when the current device instance was installed in the system.
- Type
dfdatetime.DateTimeValues
- firmware_time
date and time of the firmware.
- Type
dfdatetime.DateTimeValues
- product
product of the USB device.
- Type
str
- revision
revision number of the USB device.
- Type
str
- vendor
vendor of the USB device.
- Type
str
- DATA_TYPE = 'windows:registry:usbstor:instance'
- class plaso.parsers.winreg_plugins.usbstor.USBStorPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
USBStor key plugin.
- DATA_FORMAT = 'Windows USB Plug And Play Manager USBStor Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_usbstor_devices'
plaso.parsers.winreg_plugins.userassist module
The UserAssist Windows Registry plugin.
- class plaso.parsers.winreg_plugins.userassist.UserAssistPlugin[source]
Bases:
WindowsRegistryPlugin
,DtFabricHelper
Plugin that parses an UserAssist key.
- DATA_FORMAT = 'User Assist Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter object>})
- NAME = 'userassist'
- class plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
UserAssist Windows Registry event data.
- application_focus_count
application focus count.
- Type
int
- application_focus_duration
application focus duration.
- Type
int
- entry_index
entry index.
- Type
int
- key_path
Windows Registry key path.
- Type
str
- last_execution_time
date and time the application was last executed (or run).
- Type
dfdatetime.DateTimeValues
- number_of_executions
number of executions.
- Type
int
- value_name
name of the Windows Registry value.
- Type
str
- DATA_TYPE = 'windows:registry:userassist'
- class plaso.parsers.winreg_plugins.userassist.UserAssistWindowsRegistryKeyPathFilter(user_assist_guid)[source]
Bases:
WindowsRegistryKeyPathFilter
UserAssist Windows Registry key path filter.
plaso.parsers.winreg_plugins.windows_version module
Plug-in to collect information about the Windows version.
- class plaso.parsers.winreg_plugins.windows_version.WindowsRegistryInstallationEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows installation event data attribute container.
- build_number
Windows build number.
- Type
str
- installation_time
Windows installation date and time.
- Type
dfdatetime.DateTimeValues
- key_path
Windows Registry key path.
- Type
str
- owner
registered owner.
- Type
str
- product_name
product name.
- Type
str
- service_pack
service pack.
- Type
str
- version
Windows version.
- Type
str
- DATA_TYPE = 'windows:registry:installation'
- class plaso.parsers.winreg_plugins.windows_version.WindowsVersionPlugin[source]
Bases:
WindowsRegistryPlugin
Plug-in to collect information about the Windows version.
- DATA_FORMAT = 'Windows version (product) Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'windows_version'
plaso.parsers.winreg_plugins.winlogon module
This file contains the Winlogon Registry plugin.
- class plaso.parsers.winreg_plugins.winlogon.WinlogonEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Winlogon event data attribute container.
- application
Winlogon application.
- Type
str
- command
Winlogon command.
- Type
str
- handler
Winlogon handler.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- trigger
Winlogon trigger.
- Type
str
- DATA_TYPE = 'windows:registry:winlogon'
- class plaso.parsers.winreg_plugins.winlogon.WinlogonPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for parsing the Winlogon key.
- DATA_FORMAT = 'Windows log-on Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'winlogon'
plaso.parsers.winreg_plugins.winrar module
This file contains a WinRAR history Windows Registry plugin.
- class plaso.parsers.winreg_plugins.winrar.WinRARHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
WinRAR history event data attribute container.
- entries
archive history entries.
- Type
str
- key_path
Windows Registry key path.
- Type
str
- last_written_time
entry last written date and time.
- Type
dfdatetime.DateTimeValues
- DATA_TYPE = 'winrar:history'
- class plaso.parsers.winreg_plugins.winrar.WinRARHistoryPlugin[source]
Bases:
WindowsRegistryPlugin
Windows Registry plugin for parsing WinRAR History keys.
- DATA_FORMAT = 'WinRAR History Registry data'
- ExtractEvents(parser_mediator, registry_key, **kwargs)[source]
Extracts events from a Windows Registry key.
- Parameters
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
registry_key (dfwinreg.WinRegistryKey) – Windows Registry key.
- FILTERS = frozenset({<plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>, <plaso.parsers.winreg_plugins.interface.WindowsRegistryKeyPathFilter object>})
- NAME = 'winrar_mru'
Module contents
Imports for the Windows Registry parser.