plaso.storage package¶

Subpackages¶

Submodules¶

plaso.storage.event_tag_index module¶

The event tag index.

class plaso.storage.event_tag_index.EventTagIndex[source]¶

Bases: object

Event tag index.

The event tag index is used to map event tags to events.

It is necessary for the ZIP storage files since previously stored event tags cannot be altered.

GetEventTagByIdentifier(storage_reader, event_identifier)[source]¶

Retrieves the most recently updated event tag for an event.

Parameters

storage_reader (StorageReader) – storage reader.
event_identifier (AttributeContainerIdentifier) – event attribute container identifier.

Returns

event tag or None if the event has no event tag.

Return type

EventTag

SetEventTag(event_tag)[source]¶

Sets an event tag in the index.

Parameters: event_tag (EventTag) – event tag.

plaso.storage.factory module¶

This file contains the storage factory class.

class plaso.storage.factory.StorageFactory[source]¶

Bases: object

Storage factory.

classmethod CheckStorageFileHasSupportedFormat(path, check_readable_only=False)[source]¶

Checks if the storage file format is supported.

Parameters

path (str) – path to the storage file.
check_readable_only (Optional[bool]) – whether the store should only be checked to see if it can be read. If False, the store will be checked to see if it can be read and written to.

Returns

True if the format is supported.

Return type

bool

classmethod CreateStorageFile(storage_format)[source]¶

Creates a storage file.

Parameters

storage_format (str) – storage format.

Returns

a storage file or None if the storage file cannot be: opened or the storage format is not supported.

Return type

StorageFile

classmethod CreateStorageReaderForFile(path)[source]¶

Creates a storage reader based on the file.

Parameters

path (str) – path to the storage file.

Returns

a storage reader or None if the storage file cannot be: opened or the storage format is not supported.

Return type

StorageReader

classmethod CreateStorageWriter(storage_format)[source]¶

Creates a storage writer.

Parameters

storage_format (str) – storage format.

Returns

a storage writer or None if the storage file cannot be: opened or the storage format is not supported.

Return type

StorageWriter

classmethod CreateStorageWriterForFile(path)[source]¶

Creates a storage writer based on the file.

Parameters

path (str) – path to the storage file.

Returns

a storage writer or None if the storage file cannot be: opened or the storage format is not supported.

Return type

StorageWriter

classmethod CreateTaskStorageReader(storage_format, task, path)[source]¶

Creates a task storage reader.

Parameters

storage_format (str) – storage format.
task (Task) – task the storage changes are part of.
path (str) – path to the storage file.

Returns

a storage reader or None if the storage file cannot be: opened or the storage format is not supported.

Return type

StorageReader

classmethod CreateTaskStorageWriter(storage_format)[source]¶

Creates a task storage writer.

Parameters

storage_format (str) – storage format.

Returns

a storage writer or None if the storage file cannot be: opened or the storage format is not supported.

Return type

StorageWriter

plaso.storage.identifiers module¶

Storage attribute container identifier objects.

class plaso.storage.identifiers.FakeIdentifier(sequence_number)[source]¶

Bases: plaso.containers.interface.AttributeContainerIdentifier

Fake attribute container identifier intended for testing.

sequence_number¶

sequence number of the attribute container.

Type: int

CopyToString()[source]¶

Copies the identifier to a string representation.

Returns: unique identifier or None.
Return type: str

class plaso.storage.identifiers.RedisKeyIdentifier(name, sequence_number)[source]¶

Bases: plaso.containers.interface.AttributeContainerIdentifier

Redis key attribute container identifier.

name¶

name of the attribute container.

Type: str

sequence_number¶

sequence number of the attribute container.

Type: int

CopyToString()[source]¶

Copies the identifier to a string representation.

Returns: unique identifier or None.
Return type: str

class plaso.storage.identifiers.SQLTableIdentifier(name, sequence_number)[source]¶

Bases: plaso.containers.interface.AttributeContainerIdentifier

SQL table attribute container identifier.

The identifier is used to uniquely identify attribute containers. Where for example an attribute container is stored as a JSON serialized data in a SQLite database file.

name¶

name of the table (attribute container).

Type: str

sequence_number¶

sequence number of the attribute container.

Type: int

CopyToString()[source]¶

Copies the identifier to a string representation.

Returns: unique identifier or None.
Return type: str

property row_identifier¶

unique identifier of the row in the table.

Type: int

plaso.storage.interface module¶

The attribute container store interface.

class plaso.storage.interface.BaseStore(storage_type='session')[source]¶

Bases: object

Attribute container store interface.

format_version¶

storage format version.

Type: int

serialization_format¶

serialization format.

Type: str

storage_type¶

storage type.

Type: str

AddAttributeContainer(container)[source]¶

Adds a new attribute container.

Parameters

container (AttributeContainer) – attribute container.

Raises

OSError – if the store cannot be written to.
IOError – if the store cannot be written to.

abstract Close()[source]¶: Closes the store.

abstract GetAttributeContainerByIdentifier(container_type, identifier)[source]¶

Retrieves a specific type of container with a specific identifier.

Parameters

container_type (str) – container type.
identifier (AttributeContainerIdentifier) – attribute container identifier.

Returns

attribute container or None if not available.

Return type

AttributeContainer

Raises

IOError – when the store is closed or if an unsupported identifier is provided.
OSError – when the store is closed or if an unsupported identifier is provided.

abstract GetAttributeContainers(container_type)[source]¶

Retrieves a specific type of attribute containers.

Parameters

container_type (str) – attribute container type.

Returns

attribute container generator.

Return type

generator(AttributeContainers)

Raises

IOError – when the store is closed.
OSError – when the store is closed.

abstract GetEventTagByEventIdentifier(event_identifier)[source]¶

Retrieves the event tag related to a specific event identifier.

Parameters

event_identifier (AttributeContainerIdentifier) – event.

Returns

event tag or None if not available.

Return type

EventTag

Raises

IOError – when the store is closed.
OSError – when the store is closed.

abstract GetNumberOfAttributeContainers(container_type)[source]¶

Retrieves the number of a specific type of attribute containers.

Parameters: container_type (str) – attribute container type.
Returns: the number of containers of a specified type.
Return type: int

GetSessions()[source]¶

Retrieves the sessions.

Yields

Session – session attribute container.

Raises

IOError – if there is a mismatch in session identifiers between the session start and completion attribute containers.
OSError – if there is a mismatch in session identifiers between the session start and completion attribute containers.

abstract GetSortedEvents(time_range=None)[source]¶

Retrieves the events in increasing chronological order.

This includes all events written to the store including those pending being flushed (written) to the store.

Parameters: time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.
Yields: EventObject – event.

abstract HasAttributeContainers(container_type)[source]¶

Determines if a store contains a specific type of attribute container.

Parameters

container_type (str) – attribute container type.

Returns

True if the store contains the specified type of attribute: containers.

Return type

bool

abstract Open(**kwargs)[source]¶: Opens the store.

SetSerializersProfiler(serializers_profiler)[source]¶

Sets the serializers profiler.

Parameters: serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)[source]¶

Sets the storage profiler.

Parameters: storage_profiler (StorageProfiler) – storage profiler.

UpdateAttributeContainer(container)[source]¶

Updates an existing attribute container.

Parameters

container (AttributeContainer) – attribute container.

Raises

OSError – if the store cannot be written to.
IOError – if the store cannot be written to.

WriteTaskCompletion(task_completion)[source]¶

Writes task completion information.

Parameters

task_completion (TaskCompletion) – task completion information.

Raises

IOError – if the storage type does not support writing a task completion or if the store cannot be written to.
OSError – if the storage type does not support writing a task completion or if the store cannot be written to.

WriteTaskStart(task_start)[source]¶

Writes task start information.

Parameters

task_start (TaskStart) – task start information.

Raises

IOError – if the storage type does not support writing a task start or if the store cannot be written to.
OSError – if the storage type does not support writing a task start or if the store cannot be written to.

plaso.storage.logger module¶

The storage sub module logger.

plaso.storage.merge_reader module¶

The storage merge reader.

class plaso.storage.merge_reader.StorageMergeReader(session, storage_writer, task_storage_reader)[source]¶

Bases: object

Storage reader for merging.

number_of_containers¶

number of containers merged in last call to MergeAttributeContainers.

Type: int

AddAttributeContainer(container)[source]¶

Adds an attribute container.

Parameters: container (AttributeContainer) – attribute container.

Close()[source]¶: Closes the merge reader.

MergeAttributeContainers(maximum_number_of_containers=0)[source]¶

Reads attribute containers from a task store into the writer.

Parameters: maximum_number_of_containers (Optional[int]) – maximum number of containers to merge, where 0 represent no limit.
Returns: True if the entire task storage file has been merged.
Return type: bool

plaso.storage.reader module¶

The storage reader.

class plaso.storage.reader.StorageReader[source]¶

Bases: object

Storage reader interface.

Close()[source]¶: Closes the storage reader.

GetAttributeContainerByIdentifier(container_type, identifier)[source]¶

Retrieves a specific type of container with a specific identifier.

Parameters

container_type (str) – container type.
identifier (AttributeContainerIdentifier) – attribute container identifier.

Returns

attribute container or None if not available.

Return type

AttributeContainer

GetAttributeContainers(container_type)[source]¶

Retrieves a specific type of attribute containers.

Parameters: container_type (str) – attribute container type.
Returns: attribute container generator.
Return type: generator(AttributeContainers)

GetFormatVersion()[source]¶

Retrieves the format version of the underlying storage file.

Returns: the format version.
Return type: int

GetNumberOfAttributeContainers(container_type)[source]¶

Retrieves the number of a specific type of attribute containers.

Parameters: container_type (str) – attribute container type.
Returns: the number of containers of a specified type.
Return type: int

GetSerializationFormat()[source]¶

Retrieves the serialization format of the underlying storage file.

Returns: the serialization format.
Return type: str

GetSessions()[source]¶

Retrieves the sessions.

Returns: session generator.
Return type: generator(Session)

GetSortedEvents(time_range=None)[source]¶

Retrieves the events in increasing chronological order.

This includes all events written to the storage including those pending being flushed (written) to the storage.

Parameters: time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.
Returns: event generator.
Return type: generator(EventObject)

GetStorageType()[source]¶

Retrieves the storage type of the underlying storage file.

Returns: the storage type.
Return type: str

HasAttributeContainers(container_type)[source]¶

Determines if a store contains a specific type of attribute container.

Parameters

container_type (str) – attribute container type.

Returns

True if the store contains the specified type of attribute: containers.

Return type

bool

SetSerializersProfiler(serializers_profiler)[source]¶

Sets the serializers profiler.

Parameters: serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)[source]¶

Sets the storage profiler.

Parameters: storage_profiler (StorageProfiler) – storage profiler.

__enter__()[source]¶: Make usable with “with” statement.

__exit__(exception_type, value, traceback)[source]¶: Make usable with “with” statement.

plaso.storage.time_range module¶

Storage time range objects.

class plaso.storage.time_range.TimeRange(start_timestamp, end_timestamp)[source]¶

Bases: object

Date and time range.

The timestamp are integers containing the number of microseconds since January 1, 1970, 00:00:00 UTC.

duration¶

duration of the range in microseconds.

Type: int

end_timestamp¶

timestamp that marks the end of the range.

Type: int

start_timestamp¶

timestamp that marks the start of the range.

Type: int

plaso.storage.writer module¶

The storage writer.

class plaso.storage.writer.StorageWriter(storage_type='session')[source]¶

Bases: object

Storage writer interface.

AddAttributeContainer(container)[source]¶

Adds an attribute container.

Parameters

container (AttributeContainer) – attribute container.

Raises

IOError – when the storage writer is closed.
OSError – when the storage writer is closed.

AddOrUpdateEventTag(event_tag)[source]¶

Adds a new or updates an existing event tag.

Parameters

event_tag (EventTag) – event tag.

Raises

IOError – when the storage writer is closed.
OSError – when the storage writer is closed.

Close()[source]¶

Closes the storage writer.

Raises

IOError – when the storage writer is closed.
OSError – when the storage writer is closed.

GetAttributeContainerByIdentifier(container_type, identifier)[source]¶

Retrieves a specific type of container with a specific identifier.

Parameters

container_type (str) – container type.
identifier (AttributeContainerIdentifier) – attribute container identifier.

Returns

attribute container or None if not available.

Return type

AttributeContainer

Raises

IOError – when the storage writer is closed.
OSError – when the storage writer is closed.

GetAttributeContainerByIndex(container_type, index)[source]¶

Retrieves a specific attribute container.

Parameters

container_type (str) – attribute container type.
index (int) – attribute container index.

Returns

attribute container or None if not available.

Return type

AttributeContainer

Raises

IOError – when the storage writer is closed.
OSError – when the storage writer is closed.

GetAttributeContainers(container_type)[source]¶

Retrieves a specific type of attribute containers.

Parameters

container_type (str) – attribute container type.

Returns

attribute container generator.

Return type

generator(AttributeContainers)

Raises

IOError – when the storage writer is closed.
OSError – when the storage writer is closed.

GetEvents()[source]¶

Retrieves the events.

Returns: event generator.
Return type: generator(EventObject)

abstract GetFirstWrittenEventSource()[source]¶

Retrieves the first event source that was written after open.

Using GetFirstWrittenEventSource and GetNextWrittenEventSource newly added event sources can be retrieved in order of addition.

Returns: event source or None if there are no newly written ones.
Return type: EventSource

abstract GetNextWrittenEventSource()[source]¶

Retrieves the next event source that was written after open.

Returns: event source or None if there are no newly written ones.
Return type: EventSource

GetSessions()[source]¶

Retrieves the sessions.

Returns: session generator.
Return type: generator(Session)

GetSortedEvents(time_range=None)[source]¶

Retrieves the events in increasing chronological order.

This includes all events written to the storage including those pending being flushed (written) to the storage.

Parameters: time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.
Returns: event generator.
Return type: generator(EventObject)

abstract Open(**kwargs)[source]¶: Opens the storage writer.

SetSerializersProfiler(serializers_profiler)[source]¶

Sets the serializers profiler.

Parameters: serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)[source]¶

Sets the storage profiler.

Parameters: storage_profiler (StorageProfiler) – storage profiler.

WriteSessionCompletion(session)[source]¶

Writes session completion information.

Parameters

session (Session) – session the storage changes are part of.

Raises

IOError – when the storage writer is closed or if the storage type is not supported.
OSError – when the storage writer is closed or if the storage type is not supported.

WriteSessionConfiguration(session)[source]¶

Writes session configuration information.

Parameters

session (Session) – session the storage changes are part of.

Raises

IOError – when the storage writer is closed or if the storage type is not supported.
OSError – when the storage writer is closed or if the storage type is not supported.

WriteSessionStart(session)[source]¶

Writes session start information.

Parameters

session (Session) – session the storage changes are part of.

Raises

IOError – when the storage writer is closed or if the storage type is not supported.
OSError – when the storage writer is closed or if the storage type is not supported.

WriteTaskCompletion(task)[source]¶

Writes task completion information.

Parameters

task (Task) – task.

Raises

IOError – when the storage writer is closed or if the storage type is not supported.
OSError – when the storage writer is closed or if the storage type is not supported.

WriteTaskStart(task)[source]¶

Writes task start information.

Parameters

task (Task) – task.

Raises

IOError – when the storage writer is closed or if the storage type is not supported.
OSError – when the storage writer is closed or if the storage type is not supported.

property number_of_analysis_reports¶

number of analysis reports warnings written.

Type: int

property number_of_analysis_warnings¶

number of analysis warnings written.

Type: int

property number_of_event_sources¶

number of event sources written.

Type: int

property number_of_event_tags¶

number of event tags written.

Type: int

property number_of_events¶

number of events written.

Type: int

property number_of_extraction_warnings¶

number of extraction warnings written.

Type: int

property number_of_preprocessing_warnings¶

number of preprocessing warnings written.

Type: int

property number_of_recovery_warnings¶

number of recovery warnings written.

Type: int

plaso.storage package¶

Subpackages¶

Submodules¶

plaso.storage.event_tag_index module¶

plaso.storage.factory module¶

plaso.storage.identifiers module¶

plaso.storage.interface module¶

plaso.storage.logger module¶

plaso.storage.merge_reader module¶

plaso.storage.reader module¶

plaso.storage.time_range module¶

plaso.storage.writer module¶

Module contents¶