"""Parser for Windows Recycle files, INFO2 and $I/$R pairs."""
import os
from dfdatetime import filetime as dfdatetime_filetime
from plaso.containers import events
from plaso.lib import dtfabric_helper
from plaso.lib import errors
from plaso.parsers import interface
from plaso.parsers import manager
[docs]
class WinRecycleBinEventData(events.EventData):
"""Windows Recycle Bin event data.
Attributes:
deletion_time (dfdatetime.DateTimeValues): file entry deletion date
and time.
drive_number (int): drive number.
file_size (int): file size.
offset (int): offset of the Recycle Bin record relative to the start of
the file, from which the event data was extracted.
original_filename (str): filename.
record_index (int): index of the record, from which the event data was
extracted.
short_filename (str): short filename.
"""
DATA_TYPE = 'windows:metadata:deleted_item'
[docs]
def __init__(self):
"""Initializes Windows Recycle Bin event data."""
super().__init__(data_type=self.DATA_TYPE)
self.deletion_time = None
self.drive_number = None
self.file_size = None
self.offset = None
self.original_filename = None
self.record_index = None
self.short_filename = None
[docs]
class WinRecycleBinParser(
interface.FileObjectParser, dtfabric_helper.DtFabricHelper):
"""Parses the Windows $Recycle.Bin $I files."""
NAME = 'recycle_bin'
DATA_FORMAT = 'Windows $Recycle.Bin $I file'
_DEFINITION_FILE = os.path.join(
os.path.dirname(__file__), 'recycler.yaml')
_SUPPORTED_FORMAT_VERSIONS = (1, 2)
def _ParseOriginalFilename(self, file_object, format_version):
"""Parses the original filename.
Args:
file_object (FileIO): file-like object.
format_version (int): format version.
Returns:
str: filename or None on error.
Raises:
ParseError: if the original filename cannot be read.
"""
file_offset = file_object.tell()
if format_version == 1:
data_type_map = self._GetDataTypeMap(
'recycle_bin_metadata_utf16le_string')
else:
data_type_map = self._GetDataTypeMap(
'recycle_bin_metadata_utf16le_string_with_size')
try:
original_filename, _ = self._ReadStructureFromFileObject(
file_object, file_offset, data_type_map)
except (ValueError, errors.ParseError) as exception:
raise errors.ParseError(
f'Unable to parse original filename with error: {exception!s}')
if format_version == 1:
return original_filename.rstrip('\x00')
return original_filename.string.rstrip('\x00')
[docs]
def ParseFileObject(self, parser_mediator, file_object):
"""Parses a Windows Recycle.Bin metadata ($I) file-like object.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO): file-like object.
Raises:
WrongParser: when the file cannot be parsed.
"""
# We may have to rely on filenames since this header is very generic.
# TODO: Rethink this and potentially make a better test.
filename = parser_mediator.GetFilename()
if not filename.startswith('$I'):
raise errors.WrongParser('Filename must start with $I.')
file_header_map = self._GetDataTypeMap('recycle_bin_metadata_file_header')
try:
file_header, _ = self._ReadStructureFromFileObject(
file_object, 0, file_header_map)
except (ValueError, errors.ParseError) as exception:
raise errors.WrongParser(
f'Unable to parse Windows Recycle.Bin metadata file header with '
f'error: {exception!s}')
if file_header.format_version not in self._SUPPORTED_FORMAT_VERSIONS:
raise errors.WrongParser(
f'Unsupported format version: '
f'{file_header.format_version:d}.')
event_data = WinRecycleBinEventData()
event_data.file_size = file_header.original_file_size
try:
event_data.original_filename = self._ParseOriginalFilename(
file_object, file_header.format_version)
except (ValueError, errors.ParseError) as exception:
parser_mediator.ProduceExtractionWarning(
f'unable to parse original filename with error: {exception!s}.')
if file_header.deletion_time:
event_data.deletion_time = dfdatetime_filetime.Filetime(
timestamp=file_header.deletion_time)
parser_mediator.ProduceEventData(event_data)
[docs]
class WinRecyclerInfo2Parser(
interface.FileObjectParser, dtfabric_helper.DtFabricHelper):
"""Parses the Windows Recycler INFO2 file."""
NAME = 'recycle_bin_info2'
DATA_FORMAT = 'Windows Recycler INFO2 file'
_DEFINITION_FILE = os.path.join(
os.path.dirname(__file__), 'recycler.yaml')
_RECORD_INDEX_OFFSET = 0x104
_UNICODE_FILENAME_OFFSET = 0x118
def _ParseInfo2Record(
self, parser_mediator, file_object, record_offset, record_size):
"""Parses an INFO-2 record.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO): file-like object.
record_offset (int): record offset.
record_size (int): record size.
Raises:
ParseError: if the record cannot be read.
"""
record_data = self._ReadData(file_object, record_offset, record_size)
record_map = self._GetDataTypeMap('recycler_info2_file_entry')
try:
record = self._ReadStructureFromByteStream(
record_data, record_offset, record_map)
except (ValueError, errors.ParseError) as exception:
raise errors.ParseError((
f'Unable to map record data at offset: 0x{record_offset:08x} '
f'with error: {exception!s}'))
code_page = parser_mediator.GetCodePage()
# The original filename can contain remnant data after the end-of-string
# character.
ascii_filename = record.original_filename.split(b'\x00')[0]
try:
ascii_filename = ascii_filename.decode(code_page)
except UnicodeDecodeError:
ascii_filename = ascii_filename.decode(code_page, errors='replace')
parser_mediator.ProduceExtractionWarning(
'unable to decode original filename.')
unicode_filename = None
if record_size > 280:
record_offset += 280
utf16_string_map = self._GetDataTypeMap(
'recycler_info2_file_entry_utf16le_string')
try:
unicode_filename = self._ReadStructureFromByteStream(
record_data[280:], record_offset, utf16_string_map)
except (ValueError, errors.ParseError) as exception:
raise errors.ParseError((
f'Unable to map record data at offset: 0x{record_offset:08x} '
f'with error: {exception!s}'))
event_data = WinRecycleBinEventData()
event_data.drive_number = record.drive_number
event_data.original_filename = unicode_filename or ascii_filename
event_data.file_size = record.original_file_size
event_data.offset = record_offset
event_data.record_index = record.index
if ascii_filename != unicode_filename:
event_data.short_filename = ascii_filename
if record.deletion_time:
event_data.deletion_time = dfdatetime_filetime.Filetime(
timestamp=record.deletion_time)
parser_mediator.ProduceEventData(event_data)
[docs]
def ParseFileObject(self, parser_mediator, file_object):
"""Parses a Windows Recycler INFO2 file-like object.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO): file-like object.
Raises:
WrongParser: when the file cannot be parsed.
"""
# Since this header value is really generic it is hard not to use filename
# as an indicator too.
# TODO: Rethink this and potentially make a better test.
filename = parser_mediator.GetFilename()
if not filename.startswith('INFO2'):
return
file_header_map = self._GetDataTypeMap('recycler_info2_file_header')
try:
file_header, _ = self._ReadStructureFromFileObject(
file_object, 0, file_header_map)
except (ValueError, errors.ParseError) as exception:
raise errors.WrongParser((
f'Unable to parse Windows Recycler INFO2 file header with '
f'error: {exception!s}'))
if file_header.unknown1 != 5:
parser_mediator.ProduceExtractionWarning('unsupported format signature.')
return
file_entry_size = file_header.file_entry_size
if file_entry_size not in (280, 800):
parser_mediator.ProduceExtractionWarning(
f'unsupported file entry size: {file_entry_size:d}')
return
file_offset = file_object.get_offset()
file_size = file_object.get_size()
while file_offset < file_size:
self._ParseInfo2Record(
parser_mediator, file_object, file_offset, file_entry_size)
file_offset += file_entry_size
manager.ParsersManager.RegisterParsers([
WinRecycleBinParser, WinRecyclerInfo2Parser])