# -*- coding: utf-8 -*-
"""SQLite parser plugin for Dropbox sync_history database files."""
from dfdatetime import posix_time as dfdatetime_posix_time
from plaso.containers import events
from plaso.parsers import sqlite
from plaso.parsers.sqlite_plugins import interface
[docs]
class DropboxSyncHistoryEventData(events.EventData):
"""Dropbox Sync History Database event data.
Attributes:
event_type (str): the event type
file_event_type (str): the file event type
direction (str): the source of the synchronisation event
file_identifier (str): the Dropbox identifier of the file.
local_path (str): the local path of the file.
recorded_time (dfdatetime.DateTimeValues): date and time the log entry
was recorded.
"""
DATA_TYPE = 'dropbox:sync_history:entry'
[docs]
def __init__(self):
"""Initializes event data."""
super(DropboxSyncHistoryEventData, self).__init__(data_type=self.DATA_TYPE)
self.event_type = None
self.file_event_type = None
self.direction = None
self.file_identifier = None
self.local_path = None
self.recorded_time = None
[docs]
class DropboxSyncDatabasePlugin(interface.SQLitePlugin):
"""SQLite parser plugin for Dropbox sync_history.db database files.
The Linux sync_history.db database is typically stored in:
$HOME/.dropbox/instance1/sync_history.db
The Windows 10 sync_history.db database is typically stored in:
$HOME/AppData/Local/Dropbox/instance1/sync_history.db
"""
NAME = 'dropbox'
DATA_FORMAT = 'Dropbox sync history database (sync_history.db) file'
REQUIRED_STRUCTURE = {
'sync_history': frozenset(['timestamp', 'event_type', 'file_event_type',
'direction', 'file_id', 'local_path'])}
QUERIES = [
('SELECT timestamp, event_type, file_event_type, direction, file_id, '
'local_path FROM sync_history;',
'ParseSyncHistoryRow')]
SCHEMAS = [{
'sync_history': (
'CREATE TABLE sync_history (event_type TEXT NOT NULL, file_event_type'
' TEXT, direction TEXT, file_id TEXT, local_path TEXT, timestamp '
'INTEGER NOT NULL, other_user INTEGER')}]
def _GetDateTimeRowValue(self, query_hash, row, value_name):
"""Retrieves a date and time value from the row.
Args:
query_hash (int): hash of the query, that uniquely identifies the query
that produced the row.
row (sqlite3.Row): row.
value_name (str): name of the value.
Returns:
dfdatetime.PosixTime: date and time value or None if not available.
"""
timestamp = self._GetRowValue(query_hash, row, value_name)
if timestamp is None:
return None
return dfdatetime_posix_time.PosixTime(timestamp=timestamp)
[docs]
def ParseSyncHistoryRow(self, parser_mediator, query, row, **unused_kwargs):
"""Parses a sync_history row.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
query (str): query that created the row.
row (sqlite3.Row): row.
"""
query_hash = hash(query)
event_data = DropboxSyncHistoryEventData()
event_data.event_type = self._GetRowValue(query_hash, row, 'event_type')
event_data.file_event_type = self._GetRowValue(
query_hash, row, 'file_event_type')
event_data.direction = self._GetRowValue(query_hash, row, 'direction')
event_data.file_identifier = self._GetRowValue(query_hash, row, 'file_id')
event_data.local_path = self._GetRowValue(query_hash, row, 'local_path')
event_data.recorded_time = self._GetDateTimeRowValue(
query_hash, row, 'timestamp')
parser_mediator.ProduceEventData(event_data)
sqlite.SQLiteParser.RegisterPlugin(DropboxSyncDatabasePlugin)