plaso.storage package

Subpackages

Submodules

plaso.storage.factory module

This file contains the storage factory class.

class plaso.storage.factory.StorageFactory[source]

Bases: object

Storage factory.

classmethod CreateStorageFile(storage_format)[source]

Creates a storage file.

Parameters:

storage_format (str) – storage format.

Returns:

a storage file or None if the storage file cannot be

opened or the storage format is not supported.

Return type:

StorageFile

classmethod CreateStorageReaderForFile(path)[source]

Creates a storage reader based on the file.

Parameters:

path (str) – path to the storage file.

Returns:

a storage reader or None if the storage file cannot be

opened or the storage format is not supported.

Return type:

StorageReader

classmethod CreateStorageWriter(storage_format)[source]

Creates a storage writer.

Parameters:

storage_format (str) – storage format.

Returns:

a storage writer or None if the storage file cannot be

opened or the storage format is not supported.

Return type:

StorageWriter

classmethod CreateStorageWriterForFile(path)[source]

Creates a storage writer based on the file.

Parameters:

path (str) – path to the storage file.

Returns:

a storage writer or None if the storage file cannot be

opened or the storage format is not supported.

Return type:

StorageWriter

classmethod CreateTaskStorageReader(storage_format, task, path)[source]

Creates a task storage reader.

Parameters:
  • storage_format (str) – storage format.

  • task (Task) – task the storage changes are part of.

  • path (str) – path to the storage file.

Returns:

a storage reader or None if the storage file cannot be

opened or the storage format is not supported.

Return type:

StorageReader

classmethod CreateTaskStorageWriter(storage_format)[source]

Creates a task storage writer.

Parameters:

storage_format (str) – storage format.

Returns:

a storage writer or None if the storage file cannot be

opened or the storage format is not supported.

Return type:

StorageWriter

plaso.storage.logger module

The storage sub module logger.

plaso.storage.reader module

The storage reader.

class plaso.storage.reader.StorageReader[source]

Bases: object

Storage reader interface.

Close()[source]

Closes the storage reader.

GetAttributeContainerByIdentifier(container_type, identifier)[source]

Retrieves a specific type of container with a specific identifier.

Parameters:
  • container_type (str) – container type.

  • identifier (AttributeContainerIdentifier) – attribute container identifier.

Returns:

attribute container or None if not available.

Return type:

AttributeContainer

GetAttributeContainerByIndex(container_type, index)[source]

Retrieves a specific attribute container.

Parameters:
  • container_type (str) – attribute container type.

  • index (int) – attribute container index.

Returns:

attribute container or None if not available.

Return type:

AttributeContainer

GetAttributeContainers(container_type, filter_expression=None)[source]

Retrieves a specific type of attribute containers.

Parameters:
  • container_type (str) – attribute container type.

  • filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.

Returns:

attribute container generator.

Return type:

generator(AttributeContainers)

GetEventTagByEventIdentifer(event_identifier)[source]

Retrieves the event tag of a specific event.

Parameters:

event_identifier (AttributeContainerIdentifier) – event attribute container identifier.

Returns:

event tag or None if the event has no event tag.

Return type:

EventTag

GetFormatVersion()[source]

Retrieves the format version of the underlying storage file.

Returns:

the format version.

Return type:

int

GetNumberOfAttributeContainers(container_type)[source]

Retrieves the number of a specific type of attribute containers.

Parameters:

container_type (str) – attribute container type.

Returns:

the number of containers of a specified type.

Return type:

int

GetSerializationFormat()[source]

Retrieves the serialization format of the underlying storage file.

Returns:

the serialization format.

Return type:

str

GetSessions()[source]

Retrieves the sessions.

Yields:

Session – session attribute container.

GetSortedEvents(time_range=None)[source]

Retrieves the events in increasing chronological order.

This includes all events written to the storage including those pending being flushed (written) to the storage.

Parameters:

time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.

Returns:

event generator.

Return type:

generator(EventObject)

HasAttributeContainers(container_type)[source]

Determines if a store contains a specific type of attribute container.

Parameters:

container_type (str) – attribute container type.

Returns:

True if the store contains the specified type of attribute

containers.

Return type:

bool

SetSerializersProfiler(serializers_profiler)[source]

Sets the serializers profiler.

Parameters:

serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)[source]

Sets the storage profiler.

Parameters:

storage_profiler (StorageProfiler) – storage profiler.

__enter__()[source]

Make usable with “with” statement.

__exit__(exception_type, value, traceback)[source]

Make usable with “with” statement.

__init__()[source]

Initializes a storage reader.

plaso.storage.serializers module

This file contains the attribute container store serializers.

class plaso.storage.serializers.JSONDateTimeAttributeSerializer(*args: Any, **kwargs: Any)[source]

Bases: AttributeSerializer

JSON date time values attribute serializer.

DeserializeValue(value)[source]

Deserializes a value.

Parameters:

value (dict[str, object]) – serialized value.

Returns:

runtime value.

Return type:

dfdatetime.DateTimeValues

SerializeValue(value)[source]

Serializes a value.

Parameters:

value (dfdatetime.DateTimeValues) – runtime value.

Returns:

serialized value.

Return type:

dict[str, object]

class plaso.storage.serializers.JSONPathSpecAttributeSerializer(*args: Any, **kwargs: Any)[source]

Bases: AttributeSerializer

JSON path specification attribute serializer.

DeserializeValue(value)[source]

Deserializes a value.

Parameters:

value (dict[str, object]) – serialized value.

Returns:

runtime value.

Return type:

dfvfs.PathSpec

SerializeValue(value)[source]

Serializes a value.

Parameters:

value (dfvfs.PathSpec) – runtime value.

Returns:

serialized value.

Return type:

str

class plaso.storage.serializers.JSONStringsListAttributeSerializer(*args: Any, **kwargs: Any)[source]

Bases: AttributeSerializer

JSON strings list attribute serializer.

DeserializeValue(value)[source]

Deserializes a value.

Parameters:

value (list[str]) – serialized value.

Returns:

runtime value.

Return type:

list[str]

SerializeValue(value)[source]

Serializes a value.

Parameters:

value (list[str]) – runtime value.

Returns:

serialized value.

Return type:

list[str]

plaso.storage.time_range module

Storage time range objects.

class plaso.storage.time_range.TimeRange(start_timestamp, end_timestamp)[source]

Bases: object

Date and time range.

The timestamp are integers containing the number of microseconds since January 1, 1970, 00:00:00 UTC.

duration

duration of the range in microseconds.

Type:

int

end_timestamp

timestamp that marks the end of the range.

Type:

int

start_timestamp

timestamp that marks the start of the range.

Type:

int

__init__(start_timestamp, end_timestamp)[source]

Initializes a date and time range.

The timestamp are integers containing the number of microseconds since January 1, 1970, 00:00:00 UTC.

Parameters:
  • start_timestamp (int) – timestamp that marks the start of the range.

  • end_timestamp (int) – timestamp that marks the end of the range.

Raises:

ValueError – If the time range is badly formed.

plaso.storage.writer module

The storage writer.

class plaso.storage.writer.StorageWriter(storage_type='session')[source]

Bases: StorageReader

Storage writer interface.

AddAttributeContainer(container)[source]

Adds an attribute container.

Parameters:

container (AttributeContainer) – attribute container.

Raises:
  • IOError – when the storage writer is closed.

  • OSError – when the storage writer is closed.

AddOrUpdateEventTag(event_tag)[source]

Adds a new or updates an existing event tag.

Parameters:

event_tag (EventTag) – event tag.

Raises:
  • IOError – when the storage writer is closed.

  • OSError – when the storage writer is closed.

Close()[source]

Closes the storage writer.

Raises:
  • IOError – when the storage writer is closed.

  • OSError – when the storage writer is closed.

abstract GetFirstWrittenEventData()[source]

Retrieves the first event data that was written after open.

Using GetFirstWrittenEventData and GetNextWrittenEventData newly added event data can be retrieved in order of addition.

Returns:

event data or None if there are no newly written ones.

Return type:

EventData

abstract GetFirstWrittenEventSource()[source]

Retrieves the first event source that was written after open.

Using GetFirstWrittenEventSource and GetNextWrittenEventSource newly added event sources can be retrieved in order of addition.

Returns:

event source or None if there are no newly written ones.

Return type:

EventSource

abstract GetNextWrittenEventData()[source]

Retrieves the next event data that was written after open.

Returns:

event data or None if there are no newly written ones.

Return type:

EventData

abstract GetNextWrittenEventSource()[source]

Retrieves the next event source that was written after open.

Returns:

event source or None if there are no newly written ones.

Return type:

EventSource

abstract Open(**kwargs)[source]

Opens the storage writer.

UpdateAttributeContainer(container)[source]

Updates an existing attribute container.

Parameters:

container (AttributeContainer) – attribute container.

Raises:
  • IOError – when the storage writer is closed.

  • OSError – when the storage writer is closed.

__init__(storage_type='session')[source]

Initializes a storage writer.

Parameters:

storage_type (Optional[str]) – storage type.

Module contents

This register attribute container storage data types and serializers.