plaso.storage.fake package

Submodules

plaso.storage.fake.writer module

Fake storage writer for testing.

class plaso.storage.fake.writer.FakeStorageWriter(session, storage_type='session', task=None)

Bases: plaso.storage.interface.StorageWriter

Fake storage writer object.

analysis_reports

list[AnalysisReport] – analysis reports.

session_completion

SessionCompletion – session completion attribute container.

session_start

SessionStart – session start attribute container.

task_completion

TaskCompletion – task completion attribute container.

task_start

TaskStart – task start attribute container.

AddAnalysisReport(analysis_report)

Adds an analysis report.

Parameters:

analysis_report (AnalysisReport) – analysis report.

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

AddEvent(event)

Adds an event.

Parameters:

event (EventObject) – event.

Raises:

• IOError – when the storage writer is closed or if the event data identifier type is not supported.
• OSError – when the storage writer is closed or if the event data identifier type is not supported.

AddEventData(event_data)

Adds event data.

Parameters:

event_data (EventData) – event data.

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

AddEventSource(event_source)

Adds an event source.

Parameters:

event_source (EventSource) – event source.

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

AddEventTag(event_tag)

Adds an event tag.

Parameters:

event_tag (EventTag) – event tag.

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

AddWarning(warning)

Adds a warnings.

Parameters:

warning (ExtractionWarning) – warning.

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

Close()

Closes the storage writer.

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

CreateTaskStorage(task)

Creates a task storage.

Parameters:

task (Task) – task.

Returns:

storage writer.

Return type:

FakeStorageWriter

Raises:

• IOError – if the task storage already exists.
• OSError – if the task storage already exists.

FinalizeTaskStorage(task)

Finalizes a processed task storage.

Parameters:

task (Task) – task.

Raises:

• IOError – if the task storage does not exist.
• OSError – if the task storage does not exist.

GetEventData()

Retrieves the event data.

Returns:event data generator. Return type:generator(EventData)

GetEventDataByIdentifier(identifier)

Retrieves specific event data.

Parameters:identifier (AttributeContainerIdentifier) – event data identifier. Returns:event data or None if not available. Return type:EventData

GetEventSources()

Retrieves the event sources.

Returns:event source generator. Return type:generator(EventSource)

GetEventTags()

Retrieves the event tags.

Returns:event tag generator. Return type:generator(EventTags)

GetEvents()

Retrieves the events.

Yields:EventObject – event.

GetFirstWrittenEventSource()

Retrieves the first event source that was written after open.

Using GetFirstWrittenEventSource and GetNextWrittenEventSource newly added event sources can be retrieved in order of addition.

Returns:

event source or None if there are no newly written ones.

Return type:

EventSource

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

GetNextWrittenEventSource()

Retrieves the next event source that was written after open.

Returns:

event source or None if there are no newly written ones.

Return type:

EventSource

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

GetSortedEvents(time_range=None)

Retrieves the events in increasing chronological order.

Parameters:

time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.

Returns:

event generator.

Return type:

generator(EventObject)

Raises:

• IOError – when the storage writer is closed.
• OSError – when the storage writer is closed.

GetWarnings()

Retrieves the warnings.

Returns:warning generator. Return type:generator(ExtractionWarning)

Open()

Opens the storage writer.

Raises:

• IOError – if the storage writer is already opened.
• OSError – if the storage writer is already opened.

PrepareMergeTaskStorage(task)

Prepares a task storage for merging.

Parameters:

task (Task) – task.

Raises:

• IOError – if the task storage does not exist.
• OSError – if the task storage does not exist.

ReadPreprocessingInformation(knowledge_base)

Reads preprocessing information.

The preprocessing information contains the system configuration which contains information about various system specific configuration data, for example the user accounts.

Parameters:

knowledge_base (KnowledgeBase) – is used to store the preprocessing information.

Raises:

• IOError – if the storage type does not support writing preprocessing information or when the storage writer is closed.
• OSError – if the storage type does not support writing preprocessing information or when the storage writer is closed.

RemoveProcessedTaskStorage(task)

Removes a processed task storage.

Parameters:

task (Task) – task.

Raises:

• IOError – if the task storage does not exist.
• OSError – if the task storage does not exist.

SetSerializersProfiler(serializers_profiler)

Sets the serializers profiler.

Parameters:serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)

Sets the storage profiler.

Parameters:storage_profiler (StorageProfiler) – storage profiler.

WritePreprocessingInformation(knowledge_base)

Writes preprocessing information.

Parameters:

knowledge_base (KnowledgeBase) – used to store the preprocessing information.

Raises:

• IOError – if the storage type does not support writing preprocessing information or when the storage writer is closed.
• OSError – if the storage type does not support writing preprocessing information or when the storage writer is closed.

WriteSessionCompletion(aborted=False)

Writes session completion information.

Parameters:

aborted (Optional[bool]) – True if the session was aborted.

Raises:

• IOError – if the storage type does not support writing a session completion or when the storage writer is closed.
• OSError – if the storage type does not support writing a session completion or when the storage writer is closed.

WriteSessionStart()

Writes session start information.

Raises:

• IOError – if the storage type does not support writing a session start or when the storage writer is closed.
• OSError – if the storage type does not support writing a session start or when the storage writer is closed.

WriteTaskCompletion(aborted=False)

Writes task completion information.

Parameters:

aborted (Optional[bool]) – True if the session was aborted.

Raises:

• IOError – if the storage type does not support writing a task completion or when the storage writer is closed.
• OSError – if the storage type does not support writing a task completion or when the storage writer is closed.

WriteTaskStart()

Writes task start information.

Raises:

• IOError – if the storage type does not support writing a task start or when the storage writer is closed.
• OSError – if the storage type does not support writing a task start or when the storage writer is closed.

Module contents