Source code for plaso.parsers.sqlite_plugins.ls_quarantine

# -*- coding: utf-8 -*-
"""SQLite parser plugin for MacOS LS quarantine events database files."""

from dfdatetime import cocoa_time as dfdatetime_cocoa_time

from plaso.containers import events
from plaso.parsers import sqlite
from plaso.parsers.sqlite_plugins import interface

# TODO: describe more clearly what the data value contains.
[docs] class MacOSLSQuarantineEventData(events.EventData): """MacOS launch services quarantine event data. Attributes: agent (str): user agent that was used to download the file. data (bytes): data. downloaded_time (dfdatetime.DateTimeValues): date and time the file was downloaded. query (str): SQL query that was used to obtain the event data. url (str): original URL of the file. """ DATA_TYPE = 'macos:lsquarantine:entry'
[docs] def __init__(self): """Initializes event data.""" super(MacOSLSQuarantineEventData, self).__init__(data_type=self.DATA_TYPE) self.agent = None = None self.downloaded_time = None self.query = None self.url = None
[docs] class MacOSLSQuarantinePlugin(interface.SQLitePlugin): """SQLite parser plugin for MacOS LS quarantine events database files. The MacOS launch services (LS) quarantine database file is typically stored in: /Users/<username>/Library/Preferences/ """ NAME = 'ls_quarantine' DATA_FORMAT = ( 'MacOS launch services quarantine events database SQLite database file') REQUIRED_STRUCTURE = { 'LSQuarantineEvent': frozenset([ 'LSQuarantineTimeStamp', 'LSQuarantineAgentName', 'LSQuarantineOriginURLString', 'LSQuarantineDataURLString'])} QUERIES = [ (('SELECT LSQuarantineTimeStamp AS Time, LSQuarantineAgentName AS Agent, ' 'LSQuarantineOriginURLString AS URL, LSQuarantineDataURLString AS Data ' 'FROM LSQuarantineEvent ORDER BY Time'), 'ParseLSQuarantineRow')] SCHEMAS = [{ 'LSQuarantineEvent': ( 'CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT ' 'PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, ' 'LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName ' 'TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, ' 'LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, ' 'LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, ' 'LSQuarantineOriginAlias BLOB )')}] def _GetDateTimeRowValue(self, query_hash, row, value_name): """Retrieves a date and time value from the row. Args: query_hash (int): hash of the query, that uniquely identifies the query that produced the row. row (sqlite3.Row): row. value_name (str): name of the value. Returns: dfdatetime.CocoaTime: date and time value or None if not available. """ timestamp = self._GetRowValue(query_hash, row, value_name) if timestamp is None: return None return dfdatetime_cocoa_time.CocoaTime(timestamp=timestamp)
[docs] def ParseLSQuarantineRow( self, parser_mediator, query, row, **unused_kwargs): """Parses a launch services quarantine event row. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. query (str): query that created the row. row (sqlite3.Row): row. """ query_hash = hash(query) event_data = MacOSLSQuarantineEventData() event_data.agent = self._GetRowValue(query_hash, row, 'Agent') = self._GetRowValue(query_hash, row, 'Data') event_data.downloaded_time = self._GetDateTimeRowValue( query_hash, row, 'Time') event_data.query = query event_data.url = self._GetRowValue(query_hash, row, 'URL') parser_mediator.ProduceEventData(event_data)