plaso.parsers package

Subpackages

Submodules

plaso.parsers.android_app_usage module

Parser for the Android usage history (usage-history.xml) files.

class plaso.parsers.android_app_usage.AndroidAppUsageEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Android application usage event data.

component

name of the individual component of the application.

Type:

str

last_resume_time

date and time the application was last resumed.

Type:

dfdatetime.DateTimeValues

package

name of the Android application.

Type:

str

DATA_TYPE = 'android:app_usage'
__init__()[source]

Initializes event data.

class plaso.parsers.android_app_usage.AndroidAppUsageParser[source]

Bases: FileObjectParser

Parses the Android usage history (usage-history.xml) file.

DATA_FORMAT = 'Android usage history (usage-history.xml) file'
NAME = 'android_app_usage'
ParseFileObject(parser_mediator, file_object)[source]

Parses an Android usage-history file-like object.

Parameters:

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – file-like object.

Raises:

WrongParser – when the file cannot be parsed.

plaso.parsers.asl module

The Apple System Log (ASL) file parser.

class plaso.parsers.asl.ASLEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Apple System Log (ASL) event data.

computer_name

name of the host.

Type:

str

extra_information

extra fields associated to the event.

Type:

str

facility

facility.

Type:

str

group_identifier

group identifier (GID).

Type:

int

level

level of criticality of the event.

Type:

str

message

message of the event.

Type:

str

message_identifier

message identifier.

Type:

int

process_identifier

process identifier (PID).

Type:

int

read_group_identifier

the group identifier that can read this file, where -1 represents all.

Type:

int

read_user_identifier

user identifier that can read this file, where -1 represents all.

Type:

int

record_position

position of the event record.

Type:

int

sender

sender or process that created the event.

Type:

str

user_identifier

user identifier (UID).

Type:

int

written_time

entry written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'macos:asl:entry'
__init__()[source]

Initializes event data.

class plaso.parsers.asl.ASLFileEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Apple System Log (ASL) file event data.

creation_time

creation date and time.

Type:

dfdatetime.DateTimeValues

format_version

ASL file format version.

Type:

int

is_dirty

True if the last log entry offset does not match value in file header and the file is considered dirty.

Type:

bool

DATA_TYPE = 'macos:asl:file'
__init__()[source]

Initializes event data.

class plaso.parsers.asl.ASLParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Apple System Log (ASL) files.

DATA_FORMAT = 'Apple System Log (ASL) file'
classmethod GetFormatSpecification()[source]

Retrieves the format specification.

Returns:

format specification.

Return type:

FormatSpecification

NAME = 'asl_log'
ParseFileObject(parser_mediator, file_object)[source]

Parses an ASL file-like object.

Parameters:

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises:

WrongParser – when the file cannot be parsed.

plaso.parsers.bencode_parser module

Parser for bencoded files.

class plaso.parsers.bencode_parser.BencodeFile[source]

Bases: object

Bencode file.

Close()[source]

Closes the file.

GetValues()[source]

Retrieves the values in the root of the bencode file.

Returns:

values.

Return type:

BencodeValues

IsEmpty()[source]

Determines if the bencode file has no values (is empty).

Returns:

True if the bencode file is empty, False otherwise.

Return type:

bool

Open(file_object)[source]

Opens a bencode file.

Parameters:

file_object (dfvfs.FileIO) – file-like object.

Raises:

  • IOError – if the file-like object cannot be read.

  • OSError – if the file-like object cannot be read.

  • ValueError – if the file-like object is missing.

__init__()[source]

Initializes a bencode file.

property keys

names of all the keys.

Type:

Set[str]

class plaso.parsers.bencode_parser.BencodeParser[source]

Bases: FileObjectParser

Parser for bencoded files.

DATA_FORMAT = 'Bencoded file'
NAME = 'bencode'
ParseFileObject(parser_mediator, file_object)[source]

Parses a bencoded file-like object.

Parameters:

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises:

WrongParser – when the file cannot be parsed.

class plaso.parsers.bencode_parser.BencodeValues(decoded_values)[source]

Bases: object

Bencode values.

GetDateTimeValue(name)[source]

Retrieves a date and time value.

Parameters:

name (str) – name of the value.

Returns:

date and time or None if not available.

Return type:

dfdatetime.PosixTime

GetDecodedValue(name)[source]

Retrieves a decoded value.

Parameters:

name (str) – name of the value.

Returns:

decoded value or None if not available.

Return type:

object

GetValues()[source]

Retrieves the values.

Yields:

tuple[str, object] – name and decoded value.

__init__(decoded_values)[source]

Initializes bencode values.

Parameters:

decoded_values (collections.OrderedDict[bytes|str, object]) – decoded values.

plaso.parsers.bodyfile module

Parser for the Sleuthkit (TSK) bodyfile format.

Sleuthkit version 3 format: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime 0|/lost+found|11|d/drwx——|0|0|12288|1337961350|1337961350|1337961350|0

More information about the format specifications can be read here:

https://forensics.wiki/bodyfile

class plaso.parsers.bodyfile.BodyfileEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Bodyfile event data.

access_time

file entry last access date and time.

Type:

dfdatetime.DateTimeValues

change_time

file entry inode change (or metadata last modification) date and time.

Type:

dfdatetime.DateTimeValues

creation_time

file entry creation date and time.

Type:

dfdatetime.DateTimeValues

filename

name of the file.

Type:

str

group_identifier

group identifier (GID), equivalent to st_gid.

Type:

int

inode

“inode” of the file. Note that inode is an overloaded term in the context of a bodyfile and used for MFT entry index values as well.

Type:

int

md5

MD5 hash of the file content, formatted as a hexadecimal string.

Type:

str

mode_as_string

protection mode.

Type:

str

modification_time

file entry last modification date and time.

Type:

dfdatetime.DateTimeValues

offset

number of the corresponding line, from which the event data was extracted.

Type:

int

owner_identifier

user identifier (UID or SID) of the owner.

Type:

str

size

size of the file content.

Type:

int

path of the symbolic link target.

Type:

str

DATA_TYPE = 'fs:bodyfile:entry'
__init__()[source]

Initializes event data.

class plaso.parsers.bodyfile.BodyfileParser[source]

Bases: FileObjectParser

SleuthKit bodyfile parser.

DATA_FORMAT = 'SleuthKit version 3 bodyfile'
NAME = 'bodyfile'
ParseFileObject(parser_mediator, file_object)[source]

Parses a bodyfile file-like object.

Parameters:

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

  • file_object (dfvfs.FileIO) – file-like object.

Raises:

WrongParser – when the file cannot be parsed.

plaso.parsers.bsm module

Basic Security Module (BSM) event auditing file parser.

class plaso.parsers.bsm.BSMEventData(*args: Any, **kwargs: Any)[source]

Bases: EventData

Basic Security Module (BSM) audit event data.

event_type

identifier that represents the type of the event.

Type:

int

extra_tokens

event extra tokens, which is a list of dictionaries that contain: {token type: {token values}}

Type:

list[dict[str, dict[str, str]]]

offset

offset of the BSM record relative to the start of the file, from which the event data was extracted.

Type:

int

record_length

record length in bytes (trailer number).

Type:

int

return_value

processed return value and exit status.

Type:

str

written_time

entry written date and time.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'bsm:entry'
__init__()[source]

Initializes event data.

class plaso.parsers.bsm.BSMParser[source]

Bases: FileObjectParser, DtFabricHelper

Parser for Basic Security Module (BSM) event auditing files.

DATA_FORMAT = 'Basic Security Module (BSM) event auditing file'
NAME = 'bsm_log'
ParseFileObject(parser_mediator, file_object)[source]

Parses a BSM file-like object.

Parameters:

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • file_object (dfvfs.FileIO) – a file-like object.

Raises:

WrongParser – when the file cannot be parsed.

plaso.parsers.chrome_cache module

Parser for Google Chrome and Chromium Cache files.

class plaso.parsers.chrome_cache.CacheAddress(cache_address)[source]

Bases: object

Chrome cache address.

block_number

block data file number.

Type:

int

block_offset

offset within the block data file.

Type:

int

block_size

block size.

Type:

int

filename

name of the block data file.

Type:

str

value

cache address.

Type:

int

FILE_TYPE_BLOCK_1024 = 3
FILE_TYPE_BLOCK_256 = 2
FILE_TYPE_BLOCK_4096 = 4
FILE_TYPE_BLOCK_RANKINGS = 1
FILE_TYPE_SEPARATE = 0
__init__(cache_address)[source]

Initializes a cache address.

Parameters:

cache_address (int) – cache address.

class plaso.parsers.chrome_cache.CacheEntry[source]

Bases: object

Chrome cache entry.

creation_time

creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.

Type:

int

hash

super fast hash of the key.

Type:

int

key

key.

Type:

bytes

next

cache address of the next cache entry.

Type:

int

original_url

original URL derived from the key.

Type:

str

rankings_node

cache address of the rankings node.

Type:

int

__init__()[source]

Initializes a cache entry.

class plaso.parsers.chrome_cache.ChromeCacheDataBlockFileParser[source]

Bases: FileObjectParser, DtFabricHelper

Chrome cache data block file parser.

ParseCacheEntry(file_object, block_offset)[source]

Parses a cache entry.

Parameters:

  • file_object (dfvfs.FileIO) – a file-like object to read from.

  • block_offset (int) – block offset of the cache entry.

Returns:

cache entry.

Return type:

CacheEntry

Raises:

ParseError – if the cache entry cannot be read.

ParseFileObject(parser_mediator, file_object)