plaso.parsers package
Subpackages
- plaso.parsers.bencode_plugins package
- plaso.parsers.cookie_plugins package
- Submodules
- plaso.parsers.cookie_plugins.ganalytics module
GoogleAnalyticsUtmaEventData
GoogleAnalyticsUtmaEventData.cookie_name
GoogleAnalyticsUtmaEventData.domain_hash
GoogleAnalyticsUtmaEventData.sessions
GoogleAnalyticsUtmaEventData.url
GoogleAnalyticsUtmaEventData.visited_times
GoogleAnalyticsUtmaEventData.visitor_identifier
GoogleAnalyticsUtmaEventData.DATA_TYPE
GoogleAnalyticsUtmaEventData.__init__()
GoogleAnalyticsUtmaPlugin
GoogleAnalyticsUtmbEventData
GoogleAnalyticsUtmbPlugin
GoogleAnalyticsUtmtEventData
GoogleAnalyticsUtmtPlugin
GoogleAnalyticsUtmzEventData
GoogleAnalyticsUtmzEventData.cookie_name
GoogleAnalyticsUtmzEventData.domain_hash
GoogleAnalyticsUtmzEventData.last_visited_time
GoogleAnalyticsUtmzEventData.sessions
GoogleAnalyticsUtmzEventData.sources
GoogleAnalyticsUtmzEventData.url
GoogleAnalyticsUtmzEventData.DATA_TYPE
GoogleAnalyticsUtmzEventData.__init__()
GoogleAnalyticsUtmzPlugin
- plaso.parsers.cookie_plugins.interface module
- plaso.parsers.cookie_plugins.manager module
- Module contents
- plaso.parsers.czip_plugins package
- Submodules
- plaso.parsers.czip_plugins.interface module
- plaso.parsers.czip_plugins.oxml module
OpenXMLEventData
OpenXMLEventData.application
OpenXMLEventData.application_version
OpenXMLEventData.author
OpenXMLEventData.creation_time
OpenXMLEventData.digital_signature
OpenXMLEventData.edit_duration
OpenXMLEventData.hyperlinks_changed
OpenXMLEventData.last_printed_time
OpenXMLEventData.last_saved_by
OpenXMLEventData.links_up_to_date
OpenXMLEventData.modification_time
OpenXMLEventData.number_of_characters
OpenXMLEventData.number_of_characters_with_spaces
OpenXMLEventData.number_of_clips
OpenXMLEventData.number_of_hidden_slides
OpenXMLEventData.number_of_lines
OpenXMLEventData.number_of_pages
OpenXMLEventData.number_of_paragraphs
OpenXMLEventData.number_of_slides
OpenXMLEventData.number_of_words
OpenXMLEventData.revision_number
OpenXMLEventData.scale
OpenXMLEventData.security_flags
OpenXMLEventData.shared_doc
OpenXMLEventData.template
OpenXMLEventData.DATA_TYPE
OpenXMLEventData.__init__()
OpenXMLPlugin
- Module contents
- plaso.parsers.esedb_plugins package
- Submodules
- plaso.parsers.esedb_plugins.file_history module
FileHistoryESEDBPlugin
FileHistoryNamespaceEventData
FileHistoryNamespaceEventData.creation_time
FileHistoryNamespaceEventData.file_attribute
FileHistoryNamespaceEventData.identifier
FileHistoryNamespaceEventData.modification_time
FileHistoryNamespaceEventData.original_filename
FileHistoryNamespaceEventData.parent_identifier
FileHistoryNamespaceEventData.usn_number
FileHistoryNamespaceEventData.DATA_TYPE
FileHistoryNamespaceEventData.__init__()
- plaso.parsers.esedb_plugins.interface module
ESEDBPlugin
ESEDBPlugin.BINARY_DATA_COLUMN_TYPES
ESEDBPlugin.CheckRequiredTables()
ESEDBPlugin.DATA_FORMAT
ESEDBPlugin.FLOATING_POINT_COLUMN_TYPES
ESEDBPlugin.INTEGER_COLUMN_TYPES
ESEDBPlugin.NAME
ESEDBPlugin.OPTIONAL_TABLES
ESEDBPlugin.Process()
ESEDBPlugin.REQUIRED_TABLES
ESEDBPlugin.STRING_COLUMN_TYPES
ESEDBPlugin.__init__()
- plaso.parsers.esedb_plugins.msie_webcache module
MsieWebCacheContainerEventData
MsieWebCacheContainerEventData.access_count
MsieWebCacheContainerEventData.access_time
MsieWebCacheContainerEventData.cached_filename
MsieWebCacheContainerEventData.cached_file_size
MsieWebCacheContainerEventData.cache_identifier
MsieWebCacheContainerEventData.container_identifier
MsieWebCacheContainerEventData.creation_time
MsieWebCacheContainerEventData.entry_identifier
MsieWebCacheContainerEventData.expiration_time
MsieWebCacheContainerEventData.file_extension
MsieWebCacheContainerEventData.modification_time
MsieWebCacheContainerEventData.post_check_time
MsieWebCacheContainerEventData.redirect_url
MsieWebCacheContainerEventData.request_headers
MsieWebCacheContainerEventData.response_headers
MsieWebCacheContainerEventData.synchronization_count
MsieWebCacheContainerEventData.synchronization_time
MsieWebCacheContainerEventData.url
MsieWebCacheContainerEventData.DATA_TYPE
MsieWebCacheContainerEventData.__init__()
MsieWebCacheContainersEventData
MsieWebCacheContainersEventData.access_time
MsieWebCacheContainersEventData.container_identifier
MsieWebCacheContainersEventData.directory
MsieWebCacheContainersEventData.name
MsieWebCacheContainersEventData.scavenge_time
MsieWebCacheContainersEventData.set_identifier
MsieWebCacheContainersEventData.DATA_TYPE
MsieWebCacheContainersEventData.__init__()
MsieWebCacheCookieData
MsieWebCacheCookieData.container_identifier
MsieWebCacheCookieData.cookie_hash
MsieWebCacheCookieData.cookie_name
MsieWebCacheCookieData.cookie_value_raw
MsieWebCacheCookieData.cookie_value
MsieWebCacheCookieData.entry_identifier
MsieWebCacheCookieData.expiration_time
MsieWebCacheCookieData.flags
MsieWebCacheCookieData.modification_time
MsieWebCacheCookieData.request_domain
MsieWebCacheCookieData.DATA_TYPE
MsieWebCacheCookieData.__init__()
MsieWebCacheESEDBPlugin
MsieWebCacheESEDBPlugin.DATA_FORMAT
MsieWebCacheESEDBPlugin.GetRawCookieValue()
MsieWebCacheESEDBPlugin.NAME
MsieWebCacheESEDBPlugin.OPTIONAL_TABLES
MsieWebCacheESEDBPlugin.ParseContainersTable()
MsieWebCacheESEDBPlugin.ParseLeakFilesTable()
MsieWebCacheESEDBPlugin.ParsePartitionsTable()
MsieWebCacheESEDBPlugin.REQUIRED_TABLES
MsieWebCacheLeakFilesEventData
MsieWebCachePartitionsEventData
MsieWebCachePartitionsEventData.directory
MsieWebCachePartitionsEventData.partition_identifier
MsieWebCachePartitionsEventData.partition_type
MsieWebCachePartitionsEventData.scavenge_time
MsieWebCachePartitionsEventData.table_identifier
MsieWebCachePartitionsEventData.DATA_TYPE
MsieWebCachePartitionsEventData.__init__()
- plaso.parsers.esedb_plugins.srum module
SRUMApplicationResourceUsageEventData
SRUMApplicationResourceUsageEventData.application
SRUMApplicationResourceUsageEventData.background_bytes_read
SRUMApplicationResourceUsageEventData.background_bytes_written
SRUMApplicationResourceUsageEventData.background_context_switches
SRUMApplicationResourceUsageEventData.background_cycle_time
SRUMApplicationResourceUsageEventData.background_number_for_flushes
SRUMApplicationResourceUsageEventData.background_number_for_read_operations
SRUMApplicationResourceUsageEventData.background_number_for_write_operations
SRUMApplicationResourceUsageEventData.face_time
SRUMApplicationResourceUsageEventData.foreground_bytes_read
SRUMApplicationResourceUsageEventData.foreground_bytes_written
SRUMApplicationResourceUsageEventData.foreground_context_switches
SRUMApplicationResourceUsageEventData.foreground_cycle_time
SRUMApplicationResourceUsageEventData.foreground_number_for_flushes
SRUMApplicationResourceUsageEventData.foreground_number_for_read_operations
SRUMApplicationResourceUsageEventData.foreground_number_for_write_operations
SRUMApplicationResourceUsageEventData.identifier
SRUMApplicationResourceUsageEventData.recorded_time
SRUMApplicationResourceUsageEventData.user_identifier
SRUMApplicationResourceUsageEventData.DATA_TYPE
SRUMApplicationResourceUsageEventData.__init__()
SRUMNetworkConnectivityUsageEventData
SRUMNetworkConnectivityUsageEventData.application
SRUMNetworkConnectivityUsageEventData.identifier
SRUMNetworkConnectivityUsageEventData.interface_luid
SRUMNetworkConnectivityUsageEventData.last_connected_time
SRUMNetworkConnectivityUsageEventData.l2_profile_flags
SRUMNetworkConnectivityUsageEventData.l2_profile_identifier
SRUMNetworkConnectivityUsageEventData.recorded_time
SRUMNetworkConnectivityUsageEventData.user_identifier
SRUMNetworkConnectivityUsageEventData.DATA_TYPE
SRUMNetworkConnectivityUsageEventData.__init__()
SRUMNetworkDataUsageEventData
SRUMNetworkDataUsageEventData.application
SRUMNetworkDataUsageEventData.bytes_received
SRUMNetworkDataUsageEventData.bytes_sent
SRUMNetworkDataUsageEventData.identifier
SRUMNetworkDataUsageEventData.interface_luid
SRUMNetworkDataUsageEventData.l2_profile_flags
SRUMNetworkDataUsageEventData.l2_profile_identifier
SRUMNetworkDataUsageEventData.recorded_time
SRUMNetworkDataUsageEventData.user_identifier
SRUMNetworkDataUsageEventData.DATA_TYPE
SRUMNetworkDataUsageEventData.__init__()
SystemResourceUsageMonitorESEDBPlugin
SystemResourceUsageMonitorESEDBPlugin.DATA_FORMAT
SystemResourceUsageMonitorESEDBPlugin.NAME
SystemResourceUsageMonitorESEDBPlugin.OPTIONAL_TABLES
SystemResourceUsageMonitorESEDBPlugin.ParseApplicationResourceUsage()
SystemResourceUsageMonitorESEDBPlugin.ParseNetworkConnectivityUsage()
SystemResourceUsageMonitorESEDBPlugin.ParseNetworkDataUsage()
SystemResourceUsageMonitorESEDBPlugin.REQUIRED_TABLES
- plaso.parsers.esedb_plugins.user_access_logging module
UserAccessLoggingClientsEventsData
UserAccessLoggingClientsEventsData.access_time
UserAccessLoggingClientsEventsData.authenticated_username
UserAccessLoggingClientsEventsData.client_name
UserAccessLoggingClientsEventsData.insert_time
UserAccessLoggingClientsEventsData.role_identifier
UserAccessLoggingClientsEventsData.role_name
UserAccessLoggingClientsEventsData.source_ip_address
UserAccessLoggingClientsEventsData.tenant_identifier
UserAccessLoggingClientsEventsData.total_accesses
UserAccessLoggingClientsEventsData.DATA_TYPE
UserAccessLoggingClientsEventsData.__init__()
UserAccessLoggingDNSEventData
UserAccessLoggingESEDBPlugin
UserAccessLoggingESEDBPlugin.DATA_FORMAT
UserAccessLoggingESEDBPlugin.NAME
UserAccessLoggingESEDBPlugin.ParseClientsTable()
UserAccessLoggingESEDBPlugin.ParseDNSTable()
UserAccessLoggingESEDBPlugin.ParseRoleAccessTable()
UserAccessLoggingESEDBPlugin.ParseVirtualMachinesTable()
UserAccessLoggingESEDBPlugin.REQUIRED_TABLES
UserAccessLoggingESEDBPlugin.__init__()
UserAccessLoggingRoleAccessEventsData
UserAccessLoggingRoleAccessEventsData.first_seen_time
UserAccessLoggingRoleAccessEventsData.last_seen_time
UserAccessLoggingRoleAccessEventsData.role_identifier
UserAccessLoggingRoleAccessEventsData.role_name
UserAccessLoggingRoleAccessEventsData.DATA_TYPE
UserAccessLoggingRoleAccessEventsData.__init__()
UserAccessLoggingSystemIdentityEventdata
UserAccessLoggingSystemIdentityEventdata.creation_time
UserAccessLoggingSystemIdentityEventdata.operating_system_build
UserAccessLoggingSystemIdentityEventdata.system_dns_hostname
UserAccessLoggingSystemIdentityEventdata.system_domain_name
UserAccessLoggingSystemIdentityEventdata.DATA_TYPE
UserAccessLoggingSystemIdentityEventdata.__init__()
UserAccessLoggingVirtualMachinesEventData
UserAccessLoggingVirtualMachinesEventData.bios_identifier
UserAccessLoggingVirtualMachinesEventData.creation_time
UserAccessLoggingVirtualMachinesEventData.last_active_time
UserAccessLoggingVirtualMachinesEventData.serial_number
UserAccessLoggingVirtualMachinesEventData.vm_identifier
UserAccessLoggingVirtualMachinesEventData.DATA_TYPE
UserAccessLoggingVirtualMachinesEventData.__init__()
- Module contents
- plaso.parsers.jsonl_plugins package
- Submodules
- plaso.parsers.jsonl_plugins.aws_cloudtrail_log module
AWSCloudTrailEventData
AWSCloudTrailEventData.access_key
AWSCloudTrailEventData.account_identifier
AWSCloudTrailEventData.cloud_trail_event
AWSCloudTrailEventData.event_name
AWSCloudTrailEventData.event_source
AWSCloudTrailEventData.recorded_time
AWSCloudTrailEventData.resources
AWSCloudTrailEventData.source_ip
AWSCloudTrailEventData.user_identity_arn
AWSCloudTrailEventData.user_name
AWSCloudTrailEventData.DATA_TYPE
AWSCloudTrailEventData.__init__()
AWSCloudTrailLogJSONLPlugin
- plaso.parsers.jsonl_plugins.azure_activity_log module
AzureActivityLogEventData
AzureActivityLogEventData.caller
AzureActivityLogEventData.client_ip
AzureActivityLogEventData.correlation_identifier
AzureActivityLogEventData.event_data_identifier
AzureActivityLogEventData.event_name
AzureActivityLogEventData.level
AzureActivityLogEventData.operation_identifier
AzureActivityLogEventData.operation_name
AzureActivityLogEventData.recorded_time
AzureActivityLogEventData.resource_group
AzureActivityLogEventData.resource_identifier
AzureActivityLogEventData.resource_provider
AzureActivityLogEventData.resource_type
AzureActivityLogEventData.subscription_identifier
AzureActivityLogEventData.tenant_identifier
AzureActivityLogEventData.DATA_TYPE
AzureActivityLogEventData.__init__()
AzureActivityLogJSONLPlugin
- plaso.parsers.jsonl_plugins.azure_application_gateway_log module
AzureApplicationGatewayAccessEventData
AzureApplicationGatewayAccessEventData.client_ip
AzureApplicationGatewayAccessEventData.client_port
AzureApplicationGatewayAccessEventData.client_response_time
AzureApplicationGatewayAccessEventData.host
AzureApplicationGatewayAccessEventData.http_method
AzureApplicationGatewayAccessEventData.http_status
AzureApplicationGatewayAccessEventData.http_version
AzureApplicationGatewayAccessEventData.instance_identifier
AzureApplicationGatewayAccessEventData.original_host
AzureApplicationGatewayAccessEventData.original_request_uri
AzureApplicationGatewayAccessEventData.received_bytes
AzureApplicationGatewayAccessEventData.recorded_time
AzureApplicationGatewayAccessEventData.request_query
AzureApplicationGatewayAccessEventData.request_uri
AzureApplicationGatewayAccessEventData.sent_bytes
AzureApplicationGatewayAccessEventData.server_response_latency
AzureApplicationGatewayAccessEventData.server_routed
AzureApplicationGatewayAccessEventData.server_status
AzureApplicationGatewayAccessEventData.ssl_cipher
AzureApplicationGatewayAccessEventData.ssl_client_certificate_fingerprint
AzureApplicationGatewayAccessEventData.ssl_client_certificate_issuer_name
AzureApplicationGatewayAccessEventData.ssl_client_verify
AzureApplicationGatewayAccessEventData.ssl_enabled
AzureApplicationGatewayAccessEventData.ssl_protocol
AzureApplicationGatewayAccessEventData.time_taken
AzureApplicationGatewayAccessEventData.transaction_id
AzureApplicationGatewayAccessEventData.user_agent
AzureApplicationGatewayAccessEventData.waf_evaluation_time
AzureApplicationGatewayAccessEventData.waf_mode
AzureApplicationGatewayAccessEventData.DATA_TYPE
AzureApplicationGatewayAccessEventData.__init__()
AzureApplicationGatewayAccessLogJSONLPlugin
- plaso.parsers.jsonl_plugins.docker_container_config module
DockerContainerConfigurationEventData
DockerContainerConfigurationEventData.action
DockerContainerConfigurationEventData.container_identifier
DockerContainerConfigurationEventData.container_name
DockerContainerConfigurationEventData.creation_time
DockerContainerConfigurationEventData.end_time
DockerContainerConfigurationEventData.start_time
DockerContainerConfigurationEventData.DATA_TYPE
DockerContainerConfigurationEventData.__init__()
DockerContainerConfigurationJSONLPlugin
- plaso.parsers.jsonl_plugins.docker_container_log module
- plaso.parsers.jsonl_plugins.docker_layer_config module
- plaso.parsers.jsonl_plugins.gcp_log module
GCPLogEventData
GCPLogEventData.container
GCPLogEventData.event_subtype
GCPLogEventData.event_type
GCPLogEventData.filename
GCPLogEventData.firewall_rules
GCPLogEventData.firewall_source_ranges
GCPLogEventData.log_name
GCPLogEventData.message
GCPLogEventData.policy_deltas
GCPLogEventData.recorded_time
GCPLogEventData.request_account_identifier
GCPLogEventData.request_description
GCPLogEventData.request_direction
GCPLogEventData.request_email
GCPLogEventData.request_member
GCPLogEventData.request_metadata
GCPLogEventData.request_name
GCPLogEventData.request_target_tags
GCPLogEventData.resource_labels
GCPLogEventData.resource_name
GCPLogEventData.service_account_display_name
GCPLogEventData.service_name
GCPLogEventData.severity
GCPLogEventData.text_payload
GCPLogEventData.user
GCPLogEventData.DATA_TYPE
GCPLogEventData.__init__()
GCPLogJSONLPlugin
- plaso.parsers.jsonl_plugins.interface module
- plaso.parsers.jsonl_plugins.ios_app_privacy module
- plaso.parsers.jsonl_plugins.microsoft365_audit_log module
Microsoft365AuditLogEventData
Microsoft365AuditLogEventData.audit_record_identifier
Microsoft365AuditLogEventData.application_access_context
Microsoft365AuditLogEventData.client_ip
Microsoft365AuditLogEventData.object_identifier
Microsoft365AuditLogEventData.operation_name
Microsoft365AuditLogEventData.organization_identifier
Microsoft365AuditLogEventData.record_type
Microsoft365AuditLogEventData.recorded_time
Microsoft365AuditLogEventData.result_status
Microsoft365AuditLogEventData.scope
Microsoft365AuditLogEventData.user_identifier
Microsoft365AuditLogEventData.user_key
Microsoft365AuditLogEventData.user_type
Microsoft365AuditLogEventData.workload
Microsoft365AuditLogEventData.DATA_TYPE
Microsoft365AuditLogEventData.__init__()
Microsoft365AuditLogJSONLPlugin
- Module contents
- plaso.parsers.olecf_plugins package
- Submodules
- plaso.parsers.olecf_plugins.automatic_destinations module
AutomaticDestinationsDestListEntryEventData
AutomaticDestinationsDestListEntryEventData.birth_droid_file_identifier
AutomaticDestinationsDestListEntryEventData.birth_droid_volume_identifier
AutomaticDestinationsDestListEntryEventData.droid_file_identifier
AutomaticDestinationsDestListEntryEventData.droid_volume_identifier
AutomaticDestinationsDestListEntryEventData.entry_number
AutomaticDestinationsDestListEntryEventData.hostname
AutomaticDestinationsDestListEntryEventData.modification_time
AutomaticDestinationsDestListEntryEventData.offset
AutomaticDestinationsDestListEntryEventData.path
AutomaticDestinationsDestListEntryEventData.pin_status
AutomaticDestinationsDestListEntryEventData.DATA_TYPE
AutomaticDestinationsDestListEntryEventData.__init__()
AutomaticDestinationsOLECFPlugin
- plaso.parsers.olecf_plugins.default module
- plaso.parsers.olecf_plugins.interface module
- plaso.parsers.olecf_plugins.summary module
DocumentSummaryInformationOLECFPlugin
OLECFDocumentSummaryInformation
OLECFDocumentSummaryInformationEventData
OLECFDocumentSummaryInformationEventData.application_version
OLECFDocumentSummaryInformationEventData.category
OLECFDocumentSummaryInformationEventData.codepage
OLECFDocumentSummaryInformationEventData.company
OLECFDocumentSummaryInformationEventData.content_status
OLECFDocumentSummaryInformationEventData.content_type
OLECFDocumentSummaryInformationEventData.document_parts
OLECFDocumentSummaryInformationEventData.document_version
OLECFDocumentSummaryInformationEventData.item_creation_time
OLECFDocumentSummaryInformationEventData.item_modification_time
OLECFDocumentSummaryInformationEventData.language
OLECFDocumentSummaryInformationEventData.links_up_to_date
OLECFDocumentSummaryInformationEventData.manager
OLECFDocumentSummaryInformationEventData.number_of_bytes
OLECFDocumentSummaryInformationEventData.number_of_characters_with_white_space
OLECFDocumentSummaryInformationEventData.number_of_clips
OLECFDocumentSummaryInformationEventData.number_of_hidden_slides
OLECFDocumentSummaryInformationEventData.number_of_lines
OLECFDocumentSummaryInformationEventData.number_of_notes
OLECFDocumentSummaryInformationEventData.number_of_paragraphs
OLECFDocumentSummaryInformationEventData.number_of_slides
OLECFDocumentSummaryInformationEventData.presentation_format
OLECFDocumentSummaryInformationEventData.scale
OLECFDocumentSummaryInformationEventData.shared_document
OLECFDocumentSummaryInformationEventData.DATA_TYPE
OLECFDocumentSummaryInformationEventData.__init__()
OLECFPropertySetStream
OLECFSummaryInformation
OLECFSummaryInformationEventData
OLECFSummaryInformationEventData.application
OLECFSummaryInformationEventData.author
OLECFSummaryInformationEventData.codepage
OLECFSummaryInformationEventData.comments
OLECFSummaryInformationEventData.creation_time
OLECFSummaryInformationEventData.edit_duration
OLECFSummaryInformationEventData.item_creation_time
OLECFSummaryInformationEventData.item_modification_time
OLECFSummaryInformationEventData.keywords
OLECFSummaryInformationEventData.last_printed_time
OLECFSummaryInformationEventData.last_saved_by
OLECFSummaryInformationEventData.last_save_time
OLECFSummaryInformationEventData.number_of_characters
OLECFSummaryInformationEventData.number_of_pages
OLECFSummaryInformationEventData.number_of_words
OLECFSummaryInformationEventData.revision_number
OLECFSummaryInformationEventData.security_flags
OLECFSummaryInformationEventData.subject
OLECFSummaryInformationEventData.template
OLECFSummaryInformationEventData.title
OLECFSummaryInformationEventData.DATA_TYPE
OLECFSummaryInformationEventData.__init__()
SummaryInformationOLECFPlugin
- Module contents
- plaso.parsers.plist_plugins package
- Submodules
- plaso.parsers.plist_plugins.airport module
- plaso.parsers.plist_plugins.apple_account module
- plaso.parsers.plist_plugins.bluetooth module
MacOSBluetoothEventData
MacOSBluetoothEventData.device_identifier
MacOSBluetoothEventData.device_name
MacOSBluetoothEventData.inquiry_time
MacOSBluetoothEventData.is_paired
MacOSBluetoothEventData.name_update_time
MacOSBluetoothEventData.services_update_time
MacOSBluetoothEventData.DATA_TYPE
MacOSBluetoothEventData.__init__()
MacOSBluetoothPlistPlugin
- plaso.parsers.plist_plugins.default module
- plaso.parsers.plist_plugins.install_history module
- plaso.parsers.plist_plugins.interface module
- plaso.parsers.plist_plugins.ios_carplay module
- plaso.parsers.plist_plugins.ios_identityservices module
- plaso.parsers.plist_plugins.ipod module
IPodPlistEventData
IPodPlistEventData.device_class
IPodPlistEventData.device_identifier
IPodPlistEventData.family_identifier
IPodPlistEventData.firmware_version
IPodPlistEventData.imei
IPodPlistEventData.last_connected_time
IPodPlistEventData.serial_number
IPodPlistEventData.use_count
IPodPlistEventData.DATA_TYPE
IPodPlistEventData.__init__()
IPodPlugin
- plaso.parsers.plist_plugins.launchd module
- plaso.parsers.plist_plugins.macos_background_items module
MacOSBackgroundItemEventData
MacOSBackgroundItemEventData.name
MacOSBackgroundItemEventData.target_creation_time
MacOSBackgroundItemEventData.target_path
MacOSBackgroundItemEventData.volume_creation_time
MacOSBackgroundItemEventData.volume_flags
MacOSBackgroundItemEventData.volume_mount_point
MacOSBackgroundItemEventData.volume_name
MacOSBackgroundItemEventData.DATA_TYPE
MacOSBackgroundItemEventData.__init__()
MacOSBackgroundItemsPlistPlugin
- plaso.parsers.plist_plugins.macos_login_items module
MacOSLoginItemEventData
MacOSLoginItemEventData.hidden
MacOSLoginItemEventData.name
MacOSLoginItemEventData.target_creation_time
MacOSLoginItemEventData.target_path
MacOSLoginItemEventData.volume_creation_time
MacOSLoginItemEventData.volume_flags
MacOSLoginItemEventData.volume_mount_point
MacOSLoginItemEventData.volume_name
MacOSLoginItemEventData.DATA_TYPE
MacOSLoginItemEventData.__init__()
MacOSLoginItemsPlistPlugin
- plaso.parsers.plist_plugins.macos_login_window module
- plaso.parsers.plist_plugins.macos_startup_item module
- plaso.parsers.plist_plugins.macos_user module
MacOSUserEventData
MacOSUserEventData.fullname
MacOSUserEventData.home_directory
MacOSUserEventData.last_login_attempt_time
MacOSUserEventData.last_login_time
MacOSUserEventData.last_password_set_time
MacOSUserEventData.number_of_failed_login_attempts
MacOSUserEventData.password_hash
MacOSUserEventData.user_identifier
MacOSUserEventData.username
MacOSUserEventData.DATA_TYPE
MacOSUserEventData.__init__()
MacOSUserPlistPlugin
- plaso.parsers.plist_plugins.safari_downloads module
SafariDownloadEventData
SafariDownloadEventData.end_time
SafariDownloadEventData.full_path
SafariDownloadEventData.received_bytes
SafariDownloadEventData.remove_on_completion
SafariDownloadEventData.start_time
SafariDownloadEventData.total_bytes
SafariDownloadEventData.url
SafariDownloadEventData.DATA_TYPE
SafariDownloadEventData.__init__()
SafariDownloadsPlistPlugin
- plaso.parsers.plist_plugins.safari_history module
- plaso.parsers.plist_plugins.software_update module
- plaso.parsers.plist_plugins.spotlight_searched_terms module
- plaso.parsers.plist_plugins.spotlight_volume module
- plaso.parsers.plist_plugins.time_machine module
- Module contents
- plaso.parsers.shared package
- plaso.parsers.sqlite_plugins package
- Submodules
- plaso.parsers.sqlite_plugins.android_calls module
- plaso.parsers.sqlite_plugins.android_hangouts module
AndroidHangoutsMessageData
AndroidHangoutsMessageData.body
AndroidHangoutsMessageData.creation_time
AndroidHangoutsMessageData.message_status
AndroidHangoutsMessageData.message_type
AndroidHangoutsMessageData.offset
AndroidHangoutsMessageData.query
AndroidHangoutsMessageData.sender
AndroidHangoutsMessageData.DATA_TYPE
AndroidHangoutsMessageData.__init__()
AndroidHangoutsMessagePlugin
- plaso.parsers.sqlite_plugins.android_sms module
- plaso.parsers.sqlite_plugins.android_tango module
AndroidTangoContactEventData
AndroidTangoContactEventData.access_time
AndroidTangoContactEventData.birthday
AndroidTangoContactEventData.distance
AndroidTangoContactEventData.first_name
AndroidTangoContactEventData.friend_request_message
AndroidTangoContactEventData.friend_request_time
AndroidTangoContactEventData.friend_request_type
AndroidTangoContactEventData.gender
AndroidTangoContactEventData.is_friend
AndroidTangoContactEventData.last_active_time
AndroidTangoContactEventData.last_name
AndroidTangoContactEventData.status
AndroidTangoContactEventData.DATA_TYPE
AndroidTangoContactEventData.__init__()
AndroidTangoConversationEventData
AndroidTangoMessageEventData
AndroidTangoProfilePlugin
AndroidTangoTCPlugin
- plaso.parsers.sqlite_plugins.android_twitter module
AndroidTwitterContactEventData
AndroidTwitterContactEventData.creation_time
AndroidTwitterContactEventData.description
AndroidTwitterContactEventData.followers
AndroidTwitterContactEventData.friends
AndroidTwitterContactEventData.friendship_time
AndroidTwitterContactEventData.identifier
AndroidTwitterContactEventData.image_url
AndroidTwitterContactEventData.location
AndroidTwitterContactEventData.modification_time
AndroidTwitterContactEventData.name
AndroidTwitterContactEventData.query
AndroidTwitterContactEventData.statuses
AndroidTwitterContactEventData.user_identifier
AndroidTwitterContactEventData.username
AndroidTwitterContactEventData.web_url
AndroidTwitterContactEventData.DATA_TYPE
AndroidTwitterContactEventData.__init__()
AndroidTwitterPlugin
AndroidTwitterSearchEventData
AndroidTwitterStatusEventData
AndroidTwitterStatusEventData.author_identifier
AndroidTwitterStatusEventData.content
AndroidTwitterStatusEventData.creation_time
AndroidTwitterStatusEventData.favorited
AndroidTwitterStatusEventData.identifier
AndroidTwitterStatusEventData.query
AndroidTwitterStatusEventData.retweeted
AndroidTwitterStatusEventData.username
AndroidTwitterStatusEventData.DATA_TYPE
AndroidTwitterStatusEventData.__init__()
- plaso.parsers.sqlite_plugins.android_webview module
AndroidWebViewCookieEventData
AndroidWebViewCookieEventData.cookie_name
AndroidWebViewCookieEventData.data
AndroidWebViewCookieEventData.expiration_time
AndroidWebViewCookieEventData.host
AndroidWebViewCookieEventData.offset
AndroidWebViewCookieEventData.path
AndroidWebViewCookieEventData.query
AndroidWebViewCookieEventData.secure
AndroidWebViewCookieEventData.url
AndroidWebViewCookieEventData.DATA_TYPE
AndroidWebViewCookieEventData.__init__()
AndroidWebViewPlugin
- plaso.parsers.sqlite_plugins.android_webviewcache module
- plaso.parsers.sqlite_plugins.chrome_autofill module
- plaso.parsers.sqlite_plugins.chrome_cookies module
BaseChromeCookiePlugin
Chrome17CookiePlugin
Chrome66CookiePlugin
ChromeCookieEventData
ChromeCookieEventData.access_time
ChromeCookieEventData.cookie_name
ChromeCookieEventData.creation_time
ChromeCookieEventData.data
ChromeCookieEventData.expiration_time
ChromeCookieEventData.host
ChromeCookieEventData.httponly
ChromeCookieEventData.path
ChromeCookieEventData.persistent
ChromeCookieEventData.query
ChromeCookieEventData.secure
ChromeCookieEventData.url
ChromeCookieEventData.DATA_TYPE
ChromeCookieEventData.__init__()
- plaso.parsers.sqlite_plugins.chrome_extension_activity module
ChromeExtensionActivityEventData
ChromeExtensionActivityEventData.action_type
ChromeExtensionActivityEventData.activity_id
ChromeExtensionActivityEventData.api_name
ChromeExtensionActivityEventData.arg_url
ChromeExtensionActivityEventData.args
ChromeExtensionActivityEventData.extension_id
ChromeExtensionActivityEventData.other
ChromeExtensionActivityEventData.page_title
ChromeExtensionActivityEventData.page_url
ChromeExtensionActivityEventData.query
ChromeExtensionActivityEventData.recorded_time
ChromeExtensionActivityEventData.DATA_TYPE
ChromeExtensionActivityEventData.__init__()
ChromeExtensionActivityPlugin
- plaso.parsers.sqlite_plugins.chrome_history module
BaseGoogleChromeHistoryPlugin
ChromeHistoryFileDownloadedEventData
ChromeHistoryFileDownloadedEventData.danger_type
ChromeHistoryFileDownloadedEventData.end_time
ChromeHistoryFileDownloadedEventData.full_path
ChromeHistoryFileDownloadedEventData.interrupt_reason
ChromeHistoryFileDownloadedEventData.offset
ChromeHistoryFileDownloadedEventData.opened
ChromeHistoryFileDownloadedEventData.query
ChromeHistoryFileDownloadedEventData.received_bytes
ChromeHistoryFileDownloadedEventData.start_time
ChromeHistoryFileDownloadedEventData.state
ChromeHistoryFileDownloadedEventData.total_bytes
ChromeHistoryFileDownloadedEventData.url
ChromeHistoryFileDownloadedEventData.DATA_TYPE
ChromeHistoryFileDownloadedEventData.__init__()
ChromeHistoryPageVisitedEventData
ChromeHistoryPageVisitedEventData.from_visit
ChromeHistoryPageVisitedEventData.last_visited_time
ChromeHistoryPageVisitedEventData.offset
ChromeHistoryPageVisitedEventData.page_transition_type
ChromeHistoryPageVisitedEventData.query
ChromeHistoryPageVisitedEventData.title
ChromeHistoryPageVisitedEventData.typed_count
ChromeHistoryPageVisitedEventData.url
ChromeHistoryPageVisitedEventData.url_hidden
ChromeHistoryPageVisitedEventData.visit_count
ChromeHistoryPageVisitedEventData.visit_source
ChromeHistoryPageVisitedEventData.DATA_TYPE
ChromeHistoryPageVisitedEventData.__init__()
GoogleChrome27HistoryPlugin
GoogleChrome8HistoryPlugin
- plaso.parsers.sqlite_plugins.dropbox module
DropboxSyncDatabasePlugin
DropboxSyncHistoryEventData
DropboxSyncHistoryEventData.event_type
DropboxSyncHistoryEventData.file_event_type
DropboxSyncHistoryEventData.direction
DropboxSyncHistoryEventData.file_identifier
DropboxSyncHistoryEventData.local_path
DropboxSyncHistoryEventData.recorded_time
DropboxSyncHistoryEventData.DATA_TYPE
DropboxSyncHistoryEventData.__init__()
- plaso.parsers.sqlite_plugins.edge_load_statistics module
EdgeLoadStatisticsPlugin
EdgeLoadStatisticsResourceEventData
EdgeLoadStatisticsResourceEventData.last_update
EdgeLoadStatisticsResourceEventData.query
EdgeLoadStatisticsResourceEventData.resource_hostname
EdgeLoadStatisticsResourceEventData.resource_type
EdgeLoadStatisticsResourceEventData.top_level_hostname
EdgeLoadStatisticsResourceEventData.DATA_TYPE
EdgeLoadStatisticsResourceEventData.__init__()
- plaso.parsers.sqlite_plugins.firefox_cookies module
BaseFirefoxCookiePlugin
FirefoxCookie10Plugin
FirefoxCookie2Plugin
FirefoxCookieEventData
FirefoxCookieEventData.access_time
FirefoxCookieEventData.cookie_name
FirefoxCookieEventData.creation_time
FirefoxCookieEventData.data
FirefoxCookieEventData.expiration_time
FirefoxCookieEventData.httponly
FirefoxCookieEventData.host
FirefoxCookieEventData.offset
FirefoxCookieEventData.path
FirefoxCookieEventData.query
FirefoxCookieEventData.secure
FirefoxCookieEventData.DATA_TYPE
FirefoxCookieEventData.__init__()
- plaso.parsers.sqlite_plugins.firefox_downloads module
Firefox118DownloadEventData
Firefox118DownloadEventData.deleted
Firefox118DownloadEventData.download_state
Firefox118DownloadEventData.end_time
Firefox118DownloadEventData.expiration
Firefox118DownloadEventData.flags
Firefox118DownloadEventData.full_path
Firefox118DownloadEventData.mime_type
Firefox118DownloadEventData.name
Firefox118DownloadEventData.offset
Firefox118DownloadEventData.query
Firefox118DownloadEventData.received_bytes
Firefox118DownloadEventData.referrer
Firefox118DownloadEventData.start_time
Firefox118DownloadEventData.temporary_location
Firefox118DownloadEventData.total_bytes
Firefox118DownloadEventData.type
Firefox118DownloadEventData.url
Firefox118DownloadEventData.DATA_TYPE
Firefox118DownloadEventData.__init__()
Firefox118DownloadsPlugin
FirefoxDownloadEventData
FirefoxDownloadEventData.end_time
FirefoxDownloadEventData.full_path
FirefoxDownloadEventData.mime_type
FirefoxDownloadEventData.name
FirefoxDownloadEventData.offset
FirefoxDownloadEventData.query
FirefoxDownloadEventData.received_bytes
FirefoxDownloadEventData.referrer
FirefoxDownloadEventData.start_time
FirefoxDownloadEventData.temporary_location
FirefoxDownloadEventData.total_bytes
FirefoxDownloadEventData.url
FirefoxDownloadEventData.DATA_TYPE
FirefoxDownloadEventData.__init__()
FirefoxDownloadsPlugin
- plaso.parsers.sqlite_plugins.firefox_history module
FirefoxHistoryPlugin
FirefoxHistoryPlugin.DATA_FORMAT
FirefoxHistoryPlugin.NAME
FirefoxHistoryPlugin.ParseBookmarkAnnotationRow()
FirefoxHistoryPlugin.ParseBookmarkFolderRow()
FirefoxHistoryPlugin.ParseBookmarkRow()
FirefoxHistoryPlugin.ParsePageVisitedRow()
FirefoxHistoryPlugin.QUERIES
FirefoxHistoryPlugin.REQUIRED_STRUCTURE
FirefoxHistoryPlugin.SCHEMAS
FirefoxHistoryPlugin.URL_CACHE_QUERY
FirefoxPlacesBookmarkAnnotationEventData
FirefoxPlacesBookmarkAnnotationEventData.added_time
FirefoxPlacesBookmarkAnnotationEventData.content
FirefoxPlacesBookmarkAnnotationEventData.modification_time
FirefoxPlacesBookmarkAnnotationEventData.offset
FirefoxPlacesBookmarkAnnotationEventData.query
FirefoxPlacesBookmarkAnnotationEventData.title
FirefoxPlacesBookmarkAnnotationEventData.url
FirefoxPlacesBookmarkAnnotationEventData.DATA_TYPE
FirefoxPlacesBookmarkAnnotationEventData.__init__()
FirefoxPlacesBookmarkEventData
FirefoxPlacesBookmarkEventData.added_time
FirefoxPlacesBookmarkEventData.host
FirefoxPlacesBookmarkEventData.modification_time
FirefoxPlacesBookmarkEventData.offset
FirefoxPlacesBookmarkEventData.places_title
FirefoxPlacesBookmarkEventData.query
FirefoxPlacesBookmarkEventData.title
FirefoxPlacesBookmarkEventData.type
FirefoxPlacesBookmarkEventData.url
FirefoxPlacesBookmarkEventData.visit_count
FirefoxPlacesBookmarkEventData.DATA_TYPE
FirefoxPlacesBookmarkEventData.__init__()
FirefoxPlacesBookmarkFolderEventData
FirefoxPlacesBookmarkFolderEventData.added_time
FirefoxPlacesBookmarkFolderEventData.modification_time
FirefoxPlacesBookmarkFolderEventData.offset
FirefoxPlacesBookmarkFolderEventData.query
FirefoxPlacesBookmarkFolderEventData.title
FirefoxPlacesBookmarkFolderEventData.DATA_TYPE
FirefoxPlacesBookmarkFolderEventData.__init__()
FirefoxPlacesPageVisitedEventData
FirefoxPlacesPageVisitedEventData.from_visit
FirefoxPlacesPageVisitedEventData.hidden
FirefoxPlacesPageVisitedEventData.host
FirefoxPlacesPageVisitedEventData.last_visited_time
FirefoxPlacesPageVisitedEventData.offset
FirefoxPlacesPageVisitedEventData.query
FirefoxPlacesPageVisitedEventData.title
FirefoxPlacesPageVisitedEventData.typed
FirefoxPlacesPageVisitedEventData.url
FirefoxPlacesPageVisitedEventData.visit_count
FirefoxPlacesPageVisitedEventData.visit_type
FirefoxPlacesPageVisitedEventData.DATA_TYPE
FirefoxPlacesPageVisitedEventData.__init__()
- plaso.parsers.sqlite_plugins.gdrive module
GoogleDrivePlugin
GoogleDrivePlugin.CLOUD_PATH_CACHE_QUERY
GoogleDrivePlugin.DATA_FORMAT
GoogleDrivePlugin.GetCloudPath()
GoogleDrivePlugin.GetLocalPath()
GoogleDrivePlugin.LOCAL_PATH_CACHE_QUERY
GoogleDrivePlugin.NAME
GoogleDrivePlugin.ParseCloudEntryRow()
GoogleDrivePlugin.ParseLocalEntryRow()
GoogleDrivePlugin.QUERIES
GoogleDrivePlugin.REQUIRED_STRUCTURE
GoogleDrivePlugin.SCHEMAS
GoogleDriveSnapshotCloudEntryEventData
GoogleDriveSnapshotCloudEntryEventData.creation_time
GoogleDriveSnapshotCloudEntryEventData.doc_type
GoogleDriveSnapshotCloudEntryEventData.modification_time
GoogleDriveSnapshotCloudEntryEventData.path
GoogleDriveSnapshotCloudEntryEventData.query
GoogleDriveSnapshotCloudEntryEventData.shared
GoogleDriveSnapshotCloudEntryEventData.size
GoogleDriveSnapshotCloudEntryEventData.url
GoogleDriveSnapshotCloudEntryEventData.DATA_TYPE
GoogleDriveSnapshotCloudEntryEventData.__init__()
GoogleDriveSnapshotLocalEntryEventData
- plaso.parsers.sqlite_plugins.imessage module
IMessageEventData
IMessageEventData.attachment_location
IMessageEventData.client_version
IMessageEventData.creation_time
IMessageEventData.imessage_id
IMessageEventData.message_type
IMessageEventData.offset
IMessageEventData.query
IMessageEventData.read_receipt
IMessageEventData.service
IMessageEventData.text
IMessageEventData.DATA_TYPE
IMessageEventData.__init__()
IMessagePlugin
- plaso.parsers.sqlite_plugins.interface module
- plaso.parsers.sqlite_plugins.ios_datausage module
IOSDatausageEventData
IOSDatausageEventData.bundle_identifier
IOSDatausageEventData.process_name
IOSDatausageEventData.start_time
IOSDatausageEventData.wifi_in
IOSDatausageEventData.wifi_out
IOSDatausageEventData.wireless_wan_in
IOSDatausageEventData.wireless_wan_out
IOSDatausageEventData.DATA_TYPE
IOSDatausageEventData.__init__()
IOSDatausagePlugin
- plaso.parsers.sqlite_plugins.ios_kik module
- plaso.parsers.sqlite_plugins.ios_netusage module
IOSNetusagePlugin
IOSNetusageProcessEventData
IOSNetusageProcessEventData.process_name
IOSNetusageProcessEventData.start_time
IOSNetusageProcessEventData.wifi_in
IOSNetusageProcessEventData.wifi_out
IOSNetusageProcessEventData.wired_in
IOSNetusageProcessEventData.wired_out
IOSNetusageProcessEventData.wireless_wan_in
IOSNetusageProcessEventData.wireless_wan_out
IOSNetusageProcessEventData.DATA_TYPE
IOSNetusageProcessEventData.__init__()
IOSNetusageRouteEventData
IOSNetusageRouteEventData.bytes_in
IOSNetusageRouteEventData.bytes_out
IOSNetusageRouteEventData.network_identifier
IOSNetusageRouteEventData.network_signature
IOSNetusageRouteEventData.network_type
IOSNetusageRouteEventData.start_time
IOSNetusageRouteEventData.DATA_TYPE
IOSNetusageRouteEventData.__init__()
- plaso.parsers.sqlite_plugins.ios_powerlog module
IOSPowerlogApplicationUsageEventData
IOSPowerlogApplicationUsageEventData.background_time
IOSPowerlogApplicationUsageEventData.bundle_identifier
IOSPowerlogApplicationUsageEventData.screen_on_time
IOSPowerlogApplicationUsageEventData.start_time
IOSPowerlogApplicationUsageEventData.DATA_TYPE
IOSPowerlogApplicationUsageEventData.__init__()
IOSPowerlogApplicationUsagePlugin
IOSPowerlogApplicationUsagePlugin.DATA_FORMAT
IOSPowerlogApplicationUsagePlugin.NAME
IOSPowerlogApplicationUsagePlugin.ParseApplicationRunTime()
IOSPowerlogApplicationUsagePlugin.QUERIES
IOSPowerlogApplicationUsagePlugin.REQUIRED_STRUCTURE
IOSPowerlogApplicationUsagePlugin.REQUIRES_SCHEMA_MATCH
IOSPowerlogApplicationUsagePlugin.SCHEMAS
- plaso.parsers.sqlite_plugins.ios_screentime module
IOSScreenTimeEventData
IOSScreenTimeEventData.bundle_identifier
IOSScreenTimeEventData.device_identifier
IOSScreenTimeEventData.device_name
IOSScreenTimeEventData.domain
IOSScreenTimeEventData.start_time
IOSScreenTimeEventData.total_time
IOSScreenTimeEventData.user_family_name
IOSScreenTimeEventData.user_given_name
IOSScreenTimeEventData.DATA_TYPE
IOSScreenTimeEventData.__init__()
IOSScreenTimePlugin
- plaso.parsers.sqlite_plugins.ios_twitter module
IOSTwitterContactEventData
IOSTwitterContactEventData.creation_time
IOSTwitterContactEventData.description
IOSTwitterContactEventData.followers_count
IOSTwitterContactEventData.following_count
IOSTwitterContactEventData.following
IOSTwitterContactEventData.location
IOSTwitterContactEventData.modification_time
IOSTwitterContactEventData.name
IOSTwitterContactEventData.profile_url
IOSTwitterContactEventData.query
IOSTwitterContactEventData.screen_name
IOSTwitterContactEventData.url
IOSTwitterContactEventData.DATA_TYPE
IOSTwitterContactEventData.__init__()
IOSTwitterPlugin
IOSTwitterStatusEventData
IOSTwitterStatusEventData.creation_time
IOSTwitterStatusEventData.favorite_count
IOSTwitterStatusEventData.favorited
IOSTwitterStatusEventData.modification_time
IOSTwitterStatusEventData.name
IOSTwitterStatusEventData.query
IOSTwitterStatusEventData.retweet_count
IOSTwitterStatusEventData.text
IOSTwitterStatusEventData.user_identifier
IOSTwitterStatusEventData.DATA_TYPE
IOSTwitterStatusEventData.__init__()
- plaso.parsers.sqlite_plugins.kodi module
- plaso.parsers.sqlite_plugins.ls_quarantine module
- plaso.parsers.sqlite_plugins.mackeeper_cache module
MacKeeperCacheEventData
MacKeeperCacheEventData.added_time
MacKeeperCacheEventData.description
MacKeeperCacheEventData.event_type
MacKeeperCacheEventData.offset
MacKeeperCacheEventData.query
MacKeeperCacheEventData.record_id
MacKeeperCacheEventData.room
MacKeeperCacheEventData.text
MacKeeperCacheEventData.url
MacKeeperCacheEventData.user_name
MacKeeperCacheEventData.user_sid
MacKeeperCacheEventData.DATA_TYPE
MacKeeperCacheEventData.__init__()
MacKeeperCachePlugin
- plaso.parsers.sqlite_plugins.macos_appusage module
MacOSApplicationUsageEventData
MacOSApplicationUsageEventData.application
MacOSApplicationUsageEventData.application_version
MacOSApplicationUsageEventData.bundle_identifier
MacOSApplicationUsageEventData.count
MacOSApplicationUsageEventData.event
MacOSApplicationUsageEventData.last_used_time
MacOSApplicationUsageEventData.query
MacOSApplicationUsageEventData.DATA_TYPE
MacOSApplicationUsageEventData.__init__()
MacOSApplicationUsagePlugin
- plaso.parsers.sqlite_plugins.macos_document_versions module
MacOSDocumentVersionsEventData
MacOSDocumentVersionsEventData.creation_time
MacOSDocumentVersionsEventData.last_seen_time
MacOSDocumentVersionsEventData.name
MacOSDocumentVersionsEventData.path
MacOSDocumentVersionsEventData.query
MacOSDocumentVersionsEventData.user_sid
MacOSDocumentVersionsEventData.version_path
MacOSDocumentVersionsEventData.DATA_TYPE
MacOSDocumentVersionsEventData.__init__()
MacOSDocumentVersionsPlugin
- plaso.parsers.sqlite_plugins.macos_knowledgec module
MacOSKnowledgeCApplicationEventData
MacOSKnowledgeCApplicationEventData.bundle_identifier
MacOSKnowledgeCApplicationEventData.creation_time
MacOSKnowledgeCApplicationEventData.duration
MacOSKnowledgeCApplicationEventData.end_time
MacOSKnowledgeCApplicationEventData.start_time
MacOSKnowledgeCApplicationEventData.DATA_TYPE
MacOSKnowledgeCApplicationEventData.__init__()
MacOSKnowledgeCPlugin
MacOSKnowledgeCSafariEventData
MacOSKnowledgeCSafariEventData.bundle_identifier
MacOSKnowledgeCSafariEventData.creation_time
MacOSKnowledgeCSafariEventData.duration
MacOSKnowledgeCSafariEventData.end_time
MacOSKnowledgeCSafariEventData.start_time
MacOSKnowledgeCSafariEventData.title
MacOSKnowledgeCSafariEventData.url
MacOSKnowledgeCSafariEventData.DATA_TYPE
MacOSKnowledgeCSafariEventData.__init__()
- plaso.parsers.sqlite_plugins.macos_notes module
- plaso.parsers.sqlite_plugins.macos_notification_center module
MacOSNotificationCenterEventData
MacOSNotificationCenterEventData.body
MacOSNotificationCenterEventData.bundle_name
MacOSNotificationCenterEventData.creation_time
MacOSNotificationCenterEventData.presented
MacOSNotificationCenterEventData.subtitle
MacOSNotificationCenterEventData.title
MacOSNotificationCenterEventData.DATA_TYPE
MacOSNotificationCenterEventData.__init__()
MacOSNotificationCenterPlugin
- plaso.parsers.sqlite_plugins.macos_tcc module
- plaso.parsers.sqlite_plugins.safari module
SafariHistoryPageVisitedEventData
SafariHistoryPageVisitedEventData.host
SafariHistoryPageVisitedEventData.last_visited_time
SafariHistoryPageVisitedEventData.offset
SafariHistoryPageVisitedEventData.query
SafariHistoryPageVisitedEventData.title
SafariHistoryPageVisitedEventData.url
SafariHistoryPageVisitedEventData.visit_count
SafariHistoryPageVisitedEventData.was_http_non_get
SafariHistoryPageVisitedEventData.DATA_TYPE
SafariHistoryPageVisitedEventData.__init__()
SafariHistoryPluginSqlite
- plaso.parsers.sqlite_plugins.skype module
SkypeAccountEventData
SkypeAccountEventData.authentication_request_time
SkypeAccountEventData.authentication_request_sent_time
SkypeAccountEventData.country
SkypeAccountEventData.display_name
SkypeAccountEventData.email
SkypeAccountEventData.last_online_time
SkypeAccountEventData.last_used_time
SkypeAccountEventData.mood_change_time
SkypeAccountEventData.offset
SkypeAccountEventData.profile_change_time
SkypeAccountEventData.query
SkypeAccountEventData.username
SkypeAccountEventData.DATA_TYPE
SkypeAccountEventData.__init__()
SkypeCallEventData
SkypeCallEventData.attempt_time
SkypeCallEventData.call_type
SkypeCallEventData.dst_call
SkypeCallEventData.duration
SkypeCallEventData.end_time
SkypeCallEventData.offset
SkypeCallEventData.query
SkypeCallEventData.src_call
SkypeCallEventData.start_time
SkypeCallEventData.user_start_call
SkypeCallEventData.video_conference
SkypeCallEventData.DATA_TYPE
SkypeCallEventData.__init__()
SkypeChatEventData
SkypePlugin
SkypePlugin.DATA_FORMAT
SkypePlugin.NAME
SkypePlugin.ParseAccountInformation()
SkypePlugin.ParseCall()
SkypePlugin.ParseChat()
SkypePlugin.ParseFileTransfer()
SkypePlugin.ParseSMS()
SkypePlugin.QUERIES
SkypePlugin.QUERY_DEST_FROM_TRANSFER
SkypePlugin.QUERY_SOURCE_FROM_TRANSFER
SkypePlugin.REQUIRED_STRUCTURE
SkypePlugin.SCHEMAS
SkypeSMSEventData
SkypeTransferFileEventData
SkypeTransferFileEventData.accept_time
SkypeTransferFileEventData.destination
SkypeTransferFileEventData.end_time
SkypeTransferFileEventData.offset
SkypeTransferFileEventData.query
SkypeTransferFileEventData.source
SkypeTransferFileEventData.start_time
SkypeTransferFileEventData.transfer_status
SkypeTransferFileEventData.transferred_filename
SkypeTransferFileEventData.transferred_filepath
SkypeTransferFileEventData.transferred_filesize
SkypeTransferFileEventData.DATA_TYPE
SkypeTransferFileEventData.__init__()
- plaso.parsers.sqlite_plugins.windows_eventtranscript module
EventTranscriptPlugin
WindowsEventTranscriptEventData
WindowsEventTranscriptEventData.application_name
WindowsEventTranscriptEventData.application_root_directory
WindowsEventTranscriptEventData.application_version
WindowsEventTranscriptEventData.compressed_payload_size
WindowsEventTranscriptEventData.event_keywords
WindowsEventTranscriptEventData.event_name_hash
WindowsEventTranscriptEventData.event_name
WindowsEventTranscriptEventData.friendly_logging_binary_name
WindowsEventTranscriptEventData.ikey
WindowsEventTranscriptEventData.is_core
WindowsEventTranscriptEventData.logging_binary_name
WindowsEventTranscriptEventData.name
WindowsEventTranscriptEventData.producer_identifier
WindowsEventTranscriptEventData.provider_group_identifier
WindowsEventTranscriptEventData.recorded_time
WindowsEventTranscriptEventData.user_identifier
WindowsEventTranscriptEventData.version
WindowsEventTranscriptEventData.DATA_TYPE
WindowsEventTranscriptEventData.__init__()
- plaso.parsers.sqlite_plugins.windows_push_notification module
WindowsPushNotificationEventData
WindowsPushNotificationEventData.arrival_time
WindowsPushNotificationEventData.boot_time
WindowsPushNotificationEventData.expiration_time
WindowsPushNotificationEventData.handler_identifier
WindowsPushNotificationEventData.notification_type
WindowsPushNotificationEventData.payload
WindowsPushNotificationEventData.DATA_TYPE
WindowsPushNotificationEventData.__init__()
WindowsPushNotificationHandlerEventData
WindowsPushNotificationHandlerEventData.creation_time
WindowsPushNotificationHandlerEventData.handler_type
WindowsPushNotificationHandlerEventData.identifier
WindowsPushNotificationHandlerEventData.modification_time
WindowsPushNotificationHandlerEventData.service_identifier
WindowsPushNotificationHandlerEventData.DATA_TYPE
WindowsPushNotificationHandlerEventData.__init__()
WindowsPushNotificationPlugin
WindowsPushNotificationPlugin.DATA_FORMAT
WindowsPushNotificationPlugin.NAME
WindowsPushNotificationPlugin.ParseNotificationHandlerRow()
WindowsPushNotificationPlugin.ParseNotificationRow()
WindowsPushNotificationPlugin.QUERIES
WindowsPushNotificationPlugin.REQUIRED_STRUCTURE
WindowsPushNotificationPlugin.SCHEMAS
- plaso.parsers.sqlite_plugins.windows_timeline module
WindowsTimelineGenericEventData
WindowsTimelinePlugin
WindowsTimelineUserEngagedEventData
WindowsTimelineUserEngagedEventData.active_duration_seconds
WindowsTimelineUserEngagedEventData.package_identifier
WindowsTimelineUserEngagedEventData.reporting_app
WindowsTimelineUserEngagedEventData.start_time
WindowsTimelineUserEngagedEventData.DATA_TYPE
WindowsTimelineUserEngagedEventData.__init__()
- plaso.parsers.sqlite_plugins.zeitgeist module
- Module contents
- plaso.parsers.text_plugins package
- Submodules
- plaso.parsers.text_plugins.android_logcat module
AndroidLogcatEventData
AndroidLogcatEventData.component_tag
AndroidLogcatEventData.file_offset
AndroidLogcatEventData.message
AndroidLogcatEventData.pid
AndroidLogcatEventData.priority
AndroidLogcatEventData.recorded_time
AndroidLogcatEventData.thread_identifier
AndroidLogcatEventData.user_identifier
AndroidLogcatEventData.DATA_TYPE
AndroidLogcatEventData.__init__()
AndroidLogcatTextPlugin
- plaso.parsers.text_plugins.apache_access module
ApacheAccessLogEventData
ApacheAccessLogEventData.http_request_referer
ApacheAccessLogEventData.http_request
ApacheAccessLogEventData.http_request_user_agent
ApacheAccessLogEventData.http_response_bytes
ApacheAccessLogEventData.http_response_code
ApacheAccessLogEventData.ip_address
ApacheAccessLogEventData.port_number
ApacheAccessLogEventData.recorded_time
ApacheAccessLogEventData.remote_name
ApacheAccessLogEventData.server_name
ApacheAccessLogEventData.user_name
ApacheAccessLogEventData.DATA_TYPE
ApacheAccessLogEventData.__init__()
ApacheAccessLogTextPlugin
- plaso.parsers.text_plugins.apt_history module
- plaso.parsers.text_plugins.aws_elb_access module
AWSELBEventData
AWSELBEventData.actions_executed
AWSELBEventData.alpn_back_end_protocol
AWSELBEventData.alpn_client_preference_list
AWSELBEventData.alpn_front_end_protocol
AWSELBEventData.chosen_cert_arn
AWSELBEventData.chosen_cert_serial
AWSELBEventData.classification
AWSELBEventData.classification_reason
AWSELBEventData.connection_duration
AWSELBEventData.destination_group_arn
AWSELBEventData.destination_ip_address
AWSELBEventData.destination_list
AWSELBEventData.destination_port
AWSELBEventData.destination_processing_duration
AWSELBEventData.destination_status_code
AWSELBEventData.destination_status_code_list
AWSELBEventData.domain_name
AWSELBEventData.error_reason
AWSELBEventData.handshake_duration
AWSELBEventData.incoming_tls_alert
AWSELBEventData.listener
AWSELBEventData.matched_rule_priority
AWSELBEventData.received_bytes
AWSELBEventData.redirect_url
AWSELBEventData.request_processing_duration
AWSELBEventData.request_time
AWSELBEventData.request_type
AWSELBEventData.resource_identifier
AWSELBEventData.response_processing_duration
AWSELBEventData.response_time
AWSELBEventData.sent_bytes
AWSELBEventData.ssl_cipher
AWSELBEventData.ssl_protocol
AWSELBEventData.source_ip_address
AWSELBEventData.source_port
AWSELBEventData.tls_cipher
AWSELBEventData.tls_named_group
AWSELBEventData.tls_protocol_version
AWSELBEventData.trace_identifier
AWSELBEventData.user_agent
AWSELBEventData.version
AWSELBEventData.DATA_TYPE
AWSELBEventData.__init__()
AWSELBTextPlugin
- plaso.parsers.text_plugins.bash_history module
- plaso.parsers.text_plugins.confluence_access module
ConfluenceAccessEventData
ConfluenceAccessEventData.forwarded_for
ConfluenceAccessEventData.http_request_method
ConfluenceAccessEventData.http_request_referer
ConfluenceAccessEventData.http_request_uri
ConfluenceAccessEventData.http_request_user_agent
ConfluenceAccessEventData.http_response_bytes
ConfluenceAccessEventData.http_response_code
ConfluenceAccessEventData.http_version
ConfluenceAccessEventData.process_duration
ConfluenceAccessEventData.recorded_time
ConfluenceAccessEventData.remote_name
ConfluenceAccessEventData.thread_name
ConfluenceAccessEventData.user_name
ConfluenceAccessEventData.DATA_TYPE
ConfluenceAccessEventData.__init__()
ConfluenceAccessTextPlugin
- plaso.parsers.text_plugins.dpkg module
- plaso.parsers.text_plugins.gdrive_synclog module
GoogleDriveSyncLogEventData
GoogleDriveSyncLogEventData.added_time
GoogleDriveSyncLogEventData.level
GoogleDriveSyncLogEventData.message
GoogleDriveSyncLogEventData.process_identifier
GoogleDriveSyncLogEventData.source_code
GoogleDriveSyncLogEventData.thread
GoogleDriveSyncLogEventData.DATA_TYPE
GoogleDriveSyncLogEventData.__init__()
GoogleDriveSyncLogTextPlugin
GoogleDriveSyncLogTextPlugin.CheckRequiredFormat()
GoogleDriveSyncLogTextPlugin.DATA_FORMAT
GoogleDriveSyncLogTextPlugin.ENCODING
GoogleDriveSyncLogTextPlugin.NAME
GoogleDriveSyncLogTextPlugin.VERIFICATION_GRAMMAR
GoogleDriveSyncLogTextPlugin.VERIFICATION_LITERALS
GoogleDriveSyncLogTextPlugin.__init__()
- plaso.parsers.text_plugins.google_logging module
- plaso.parsers.text_plugins.iis module
IISEventData
IISEventData.cs_cookie
IISEventData.cs_host
IISEventData.cs_referrer
IISEventData.cs_uri_query
IISEventData.cs_username
IISEventData.dest_ip
IISEventData.dest_port
IISEventData.http_method
IISEventData.http_status
IISEventData.last_written_time
IISEventData.protocol_version
IISEventData.received_bytes
IISEventData.requested_uri_stem
IISEventData.s_computername
IISEventData.sc_substatus
IISEventData.sc_win32_status
IISEventData.sent_bytes
IISEventData.source_ip
IISEventData.s_sitename
IISEventData.time_taken
IISEventData.user_agent
IISEventData.DATA_TYPE
IISEventData.__init__()
WinIISTextPlugin
- plaso.parsers.text_plugins.interface module
- plaso.parsers.text_plugins.ios_lockdownd module
- plaso.parsers.text_plugins.ios_logd module
- plaso.parsers.text_plugins.ios_sysdiag_log module
- plaso.parsers.text_plugins.macos_appfirewall module
MacOSAppFirewallLogEventData
MacOSAppFirewallLogEventData.action
MacOSAppFirewallLogEventData.added_time
MacOSAppFirewallLogEventData.agent
MacOSAppFirewallLogEventData.computer_name
MacOSAppFirewallLogEventData.process_name
MacOSAppFirewallLogEventData.status
MacOSAppFirewallLogEventData.DATA_TYPE
MacOSAppFirewallLogEventData.__init__()
MacOSAppFirewallTextPlugin
- plaso.parsers.text_plugins.macos_launchd module
- plaso.parsers.text_plugins.macos_securityd module
MacOSSecuritydLogEventData
MacOSSecuritydLogEventData.added_time
MacOSSecuritydLogEventData.caller
MacOSSecuritydLogEventData.facility
MacOSSecuritydLogEventData.level
MacOSSecuritydLogEventData.message
MacOSSecuritydLogEventData.security_api
MacOSSecuritydLogEventData.sender
MacOSSecuritydLogEventData.sender_pid
MacOSSecuritydLogEventData.DATA_TYPE
MacOSSecuritydLogEventData.__init__()
MacOSSecuritydLogTextPlugin
- plaso.parsers.text_plugins.macos_wifi module
- plaso.parsers.text_plugins.popcontest module
PopularityContestEventData
PopularityContestSessionEventData
PopularityContestSessionEventData.details
PopularityContestSessionEventData.end_time
PopularityContestSessionEventData.host_identifier
PopularityContestSessionEventData.session
PopularityContestSessionEventData.start_time
PopularityContestSessionEventData.DATA_TYPE
PopularityContestSessionEventData.__init__()
PopularityContestTextPlugin
- plaso.parsers.text_plugins.postgresql module
- plaso.parsers.text_plugins.powershell_transcript module
PowerShellTranscriptLogEventData
PowerShellTranscriptLogEventData.build_version
PowerShellTranscriptLogEventData.clr_version
PowerShellTranscriptLogEventData.commands
PowerShellTranscriptLogEventData.compatible_versions
PowerShellTranscriptLogEventData.configuration_name
PowerShellTranscriptLogEventData.edition
PowerShellTranscriptLogEventData.host_application
PowerShellTranscriptLogEventData.machine
PowerShellTranscriptLogEventData.process_identifier
PowerShellTranscriptLogEventData.remoting_protocol_version
PowerShellTranscriptLogEventData.runas_user
PowerShellTranscriptLogEventData.serialization_version
PowerShellTranscriptLogEventData.start_time
PowerShellTranscriptLogEventData.username
PowerShellTranscriptLogEventData.version
PowerShellTranscriptLogEventData.ws_man_stack_version
PowerShellTranscriptLogEventData.DATA_TYPE
PowerShellTranscriptLogEventData.__init__()
PowerShellTranscriptLogTextPlugin
PowerShellTranscriptLogTextPlugin.CheckRequiredFormat()
PowerShellTranscriptLogTextPlugin.DATA_FORMAT
PowerShellTranscriptLogTextPlugin.ENCODING
PowerShellTranscriptLogTextPlugin.NAME
PowerShellTranscriptLogTextPlugin.VERIFICATION_GRAMMAR
PowerShellTranscriptLogTextPlugin.VERIFICATION_LITERALS
PowerShellTranscriptLogTextPlugin.__init__()
- plaso.parsers.text_plugins.santa module
SantaExecutionEventData
SantaExecutionEventData.action
SantaExecutionEventData.certificate_common_name
SantaExecutionEventData.certificate_hash
SantaExecutionEventData.decision
SantaExecutionEventData.gid
SantaExecutionEventData.group
SantaExecutionEventData.last_run_time
SantaExecutionEventData.long_reason
SantaExecutionEventData.mode
SantaExecutionEventData.pid
SantaExecutionEventData.pid_version
SantaExecutionEventData.ppid
SantaExecutionEventData.process_arguments
SantaExecutionEventData.process_hash
SantaExecutionEventData.process_path
SantaExecutionEventData.reason
SantaExecutionEventData.uid
SantaExecutionEventData.user
SantaExecutionEventData.DATA_TYPE
SantaExecutionEventData.__init__()
SantaFileSystemEventData
SantaFileSystemEventData.action
SantaFileSystemEventData.file_new_path
SantaFileSystemEventData.file_path
SantaFileSystemEventData.gid
SantaFileSystemEventData.group
SantaFileSystemEventData.last_written_time
SantaFileSystemEventData.pid
SantaFileSystemEventData.pid_version
SantaFileSystemEventData.ppid
SantaFileSystemEventData.process_path
SantaFileSystemEventData.process
SantaFileSystemEventData.uid
SantaFileSystemEventData.user
SantaFileSystemEventData.DATA_TYPE
SantaFileSystemEventData.__init__()
SantaMountEventData
SantaMountEventData.action
SantaMountEventData.appearance_time
SantaMountEventData.bsd_name
SantaMountEventData.bus
SantaMountEventData.dmg_path
SantaMountEventData.fs
SantaMountEventData.last_written_time
SantaMountEventData.model
SantaMountEventData.mount
SantaMountEventData.serial
SantaMountEventData.volume
SantaMountEventData.DATA_TYPE
SantaMountEventData.__init__()
SantaProcessExitEventData
SantaProcessExitEventData.action
SantaProcessExitEventData.exit_time
SantaProcessExitEventData.gid
SantaProcessExitEventData.pid
SantaProcessExitEventData.pid_version
SantaProcessExitEventData.ppid
SantaProcessExitEventData.uid
SantaProcessExitEventData.DATA_TYPE
SantaProcessExitEventData.__init__()
SantaTextPlugin
- plaso.parsers.text_plugins.sccm module
- plaso.parsers.text_plugins.selinux module
- plaso.parsers.text_plugins.setupapi module
- plaso.parsers.text_plugins.skydrivelog module
- plaso.parsers.text_plugins.snort_fastlog module
SnortFastAlertEventData
SnortFastAlertEventData.classification
SnortFastAlertEventData.destination_ip
SnortFastAlertEventData.destination_port
SnortFastAlertEventData.last_written_time
SnortFastAlertEventData.message
SnortFastAlertEventData.priority
SnortFastAlertEventData.rule_identifier
SnortFastAlertEventData.source_ip
SnortFastAlertEventData.source_port
SnortFastAlertEventData.DATA_TYPE
SnortFastAlertEventData.__init__()
SnortFastLogTextPlugin
- plaso.parsers.text_plugins.sophos_av module
- plaso.parsers.text_plugins.syslog module
- plaso.parsers.text_plugins.teamviewer module
TeamViewerApplicationEventData
TeamViewerApplicationLogTextPlugin
TeamViewerConnectionsIncomingEventData
TeamViewerConnectionsIncomingEventData.activity_type
TeamViewerConnectionsIncomingEventData.connection_identifier
TeamViewerConnectionsIncomingEventData.display_name
TeamViewerConnectionsIncomingEventData.end_time
TeamViewerConnectionsIncomingEventData.local_account
TeamViewerConnectionsIncomingEventData.source_identifier
TeamViewerConnectionsIncomingEventData.start_time
TeamViewerConnectionsIncomingEventData.DATA_TYPE
TeamViewerConnectionsIncomingEventData.__init__()
TeamViewerConnectionsIncomingLogTextPlugin
TeamViewerConnectionsOutgoingEventData
TeamViewerConnectionsOutgoingEventData.activity_type
TeamViewerConnectionsOutgoingEventData.connection_identifier
TeamViewerConnectionsOutgoingEventData.destination_identifier
TeamViewerConnectionsOutgoingEventData.end_time
TeamViewerConnectionsOutgoingEventData.local_account
TeamViewerConnectionsOutgoingEventData.start_time
TeamViewerConnectionsOutgoingEventData.DATA_TYPE
TeamViewerConnectionsOutgoingEventData.__init__()
TeamViewerConnectionsOutgoingLogTextPlugin
- plaso.parsers.text_plugins.viminfo module
- plaso.parsers.text_plugins.vsftpd module
- plaso.parsers.text_plugins.winfirewall module
WinFirewallEventData
WinFirewallEventData.action
WinFirewallEventData.destination_ip
WinFirewallEventData.destination_port
WinFirewallEventData.icmp_code
WinFirewallEventData.icmp_type
WinFirewallEventData.information
WinFirewallEventData.last_written_time
WinFirewallEventData.packet_size
WinFirewallEventData.path
WinFirewallEventData.protocol
WinFirewallEventData.source_ip
WinFirewallEventData.source_port
WinFirewallEventData.tcp_ack
WinFirewallEventData.tcp_flags
WinFirewallEventData.tcp_sequence_number
WinFirewallEventData.tcp_window_size
WinFirewallEventData.DATA_TYPE
WinFirewallEventData.__init__()
WinFirewallLogTextPlugin
- plaso.parsers.text_plugins.xchatlog module
- plaso.parsers.text_plugins.xchatscrollback module
- plaso.parsers.text_plugins.zsh_extended_history module
- Module contents
- plaso.parsers.winreg_plugins package
- Submodules
- plaso.parsers.winreg_plugins.amcache module
AMCacheFileEventData
AMCacheFileEventData.company_name
AMCacheFileEventData.file_creation_time
AMCacheFileEventData.file_description
AMCacheFileEventData.file_modification_time
AMCacheFileEventData.file_reference
AMCacheFileEventData.file_size
AMCacheFileEventData.file_version
AMCacheFileEventData.full_path
AMCacheFileEventData.installation_time
AMCacheFileEventData.language_code
AMCacheFileEventData.last_written_time
AMCacheFileEventData.link_time
AMCacheFileEventData.msi_installation_time
AMCacheFileEventData.product_name
AMCacheFileEventData.program_identifier
AMCacheFileEventData.sha1
AMCacheFileEventData.DATA_TYPE
AMCacheFileEventData.__init__()
AMCachePlugin
AMCacheProgramEventData
AMCacheProgramEventData.entry_type
AMCacheProgramEventData.file_paths
AMCacheProgramEventData.files
AMCacheProgramEventData.installation_time
AMCacheProgramEventData.language_code
AMCacheProgramEventData.msi_package_code
AMCacheProgramEventData.msi_product_code
AMCacheProgramEventData.name
AMCacheProgramEventData.package_code
AMCacheProgramEventData.product_code
AMCacheProgramEventData.publisher
AMCacheProgramEventData.uninstall_key
AMCacheProgramEventData.version
AMCacheProgramEventData.DATA_TYPE
AMCacheProgramEventData.__init__()
- plaso.parsers.winreg_plugins.appcompatcache module
- plaso.parsers.winreg_plugins.bagmru module
- plaso.parsers.winreg_plugins.bam module
- plaso.parsers.winreg_plugins.ccleaner module
- plaso.parsers.winreg_plugins.default module
- plaso.parsers.winreg_plugins.interface module
- plaso.parsers.winreg_plugins.lfu module
- plaso.parsers.winreg_plugins.mountpoints module
- plaso.parsers.winreg_plugins.mrulist module
- plaso.parsers.winreg_plugins.mrulistex module
- plaso.parsers.winreg_plugins.msie_zones module
- plaso.parsers.winreg_plugins.network_drives module
- plaso.parsers.winreg_plugins.networks module
NetworksWindowsRegistryPlugin
WindowsRegistryNetworkListEventData
WindowsRegistryNetworkListEventData.connection_type
WindowsRegistryNetworkListEventData.creation_time
WindowsRegistryNetworkListEventData.default_gateway_mac
WindowsRegistryNetworkListEventData.description
WindowsRegistryNetworkListEventData.dns_suffix
WindowsRegistryNetworkListEventData.key_path
WindowsRegistryNetworkListEventData.last_connected_time
WindowsRegistryNetworkListEventData.ssid
WindowsRegistryNetworkListEventData.DATA_TYPE
WindowsRegistryNetworkListEventData.__init__()
- plaso.parsers.winreg_plugins.officemru module
- plaso.parsers.winreg_plugins.outlook module
- plaso.parsers.winreg_plugins.programscache module
ExplorerProgramsCacheEventData
ExplorerProgramsCacheEventData.entries
ExplorerProgramsCacheEventData.key_path
ExplorerProgramsCacheEventData.known_folder_identifier
ExplorerProgramsCacheEventData.last_written_time
ExplorerProgramsCacheEventData.value_name
ExplorerProgramsCacheEventData.DATA_TYPE
ExplorerProgramsCacheEventData.__init__()
ExplorerProgramsCacheWindowsRegistryPlugin
- plaso.parsers.winreg_plugins.run module
- plaso.parsers.winreg_plugins.sam_users module
SAMUsersWindowsRegistryEventData
SAMUsersWindowsRegistryEventData.account_rid
SAMUsersWindowsRegistryEventData.comments
SAMUsersWindowsRegistryEventData.fullname
SAMUsersWindowsRegistryEventData.key_path
SAMUsersWindowsRegistryEventData.last_login_time
SAMUsersWindowsRegistryEventData.last_password_set_time
SAMUsersWindowsRegistryEventData.last_written_time
SAMUsersWindowsRegistryEventData.login_count
SAMUsersWindowsRegistryEventData.username
SAMUsersWindowsRegistryEventData.DATA_TYPE
SAMUsersWindowsRegistryEventData.__init__()
SAMUsersWindowsRegistryPlugin
- plaso.parsers.winreg_plugins.services module
ServicesPlugin
WindowsRegistryServiceEventData
WindowsRegistryServiceEventData.error_control
WindowsRegistryServiceEventData.image_path
WindowsRegistryServiceEventData.key_path
WindowsRegistryServiceEventData.last_written_time
WindowsRegistryServiceEventData.name
WindowsRegistryServiceEventData.object_name
WindowsRegistryServiceEventData.service_dll
WindowsRegistryServiceEventData.service_type
WindowsRegistryServiceEventData.start_type
WindowsRegistryServiceEventData.values
WindowsRegistryServiceEventData.values
WindowsRegistryServiceEventData.DATA_TYPE
WindowsRegistryServiceEventData.__init__()
- plaso.parsers.winreg_plugins.shutdown module
- plaso.parsers.winreg_plugins.task_scheduler module
- plaso.parsers.winreg_plugins.terminal_server module
TerminalServerClientConnectionEventData
TerminalServerClientConnectionEventData.entries
TerminalServerClientConnectionEventData.key_path
TerminalServerClientConnectionEventData.last_written_time
TerminalServerClientConnectionEventData.username
TerminalServerClientConnectionEventData.DATA_TYPE
TerminalServerClientConnectionEventData.__init__()
TerminalServerClientMRUEventData
TerminalServerClientMRUPlugin
TerminalServerClientPlugin
- plaso.parsers.winreg_plugins.timezone module
- plaso.parsers.winreg_plugins.typedurls module
- plaso.parsers.winreg_plugins.usb module
- plaso.parsers.winreg_plugins.usbstor module
USBStorDeviceInstanceEventData
USBStorDeviceInstanceEventData.device_last_arrival_time
USBStorDeviceInstanceEventData.device_last_removal_time
USBStorDeviceInstanceEventData.device_type
USBStorDeviceInstanceEventData.display_name
USBStorDeviceInstanceEventData.key_path
USBStorDeviceInstanceEventData.driver_first_installation_time
USBStorDeviceInstanceEventData.driver_last_installation_time
USBStorDeviceInstanceEventData.firmware_time
USBStorDeviceInstanceEventData.product
USBStorDeviceInstanceEventData.revision
USBStorDeviceInstanceEventData.vendor
USBStorDeviceInstanceEventData.DATA_TYPE
USBStorDeviceInstanceEventData.__init__()
USBStorPlugin
- plaso.parsers.winreg_plugins.userassist module
UserAssistPlugin
UserAssistWindowsRegistryEventData
UserAssistWindowsRegistryEventData.application_focus_count
UserAssistWindowsRegistryEventData.application_focus_duration
UserAssistWindowsRegistryEventData.entry_index
UserAssistWindowsRegistryEventData.key_path
UserAssistWindowsRegistryEventData.last_execution_time
UserAssistWindowsRegistryEventData.number_of_executions
UserAssistWindowsRegistryEventData.value_name
UserAssistWindowsRegistryEventData.DATA_TYPE
UserAssistWindowsRegistryEventData.__init__()
UserAssistWindowsRegistryKeyPathFilter
- plaso.parsers.winreg_plugins.windows_version module
WindowsRegistryInstallationEventData
WindowsRegistryInstallationEventData.build_number
WindowsRegistryInstallationEventData.installation_time
WindowsRegistryInstallationEventData.key_path
WindowsRegistryInstallationEventData.owner
WindowsRegistryInstallationEventData.product_name
WindowsRegistryInstallationEventData.service_pack
WindowsRegistryInstallationEventData.version
WindowsRegistryInstallationEventData.DATA_TYPE
WindowsRegistryInstallationEventData.__init__()
WindowsVersionPlugin
- plaso.parsers.winreg_plugins.winlogon module
- plaso.parsers.winreg_plugins.winrar module
- Module contents
Submodules
plaso.parsers.android_app_usage module
Parser for the Android usage history (usage-history.xml) files.
- class plaso.parsers.android_app_usage.AndroidAppUsageEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Android application usage event data.
- component
name of the individual component of the application.
- Type:
str
- last_resume_time
date and time the application was last resumed.
- Type:
dfdatetime.DateTimeValues
- package
name of the Android application.
- Type:
str
- DATA_TYPE = 'android:app_usage'
- class plaso.parsers.android_app_usage.AndroidAppUsageParser[source]
Bases:
FileObjectParser
Parses the Android usage history (usage-history.xml) file.
- DATA_FORMAT = 'Android usage history (usage-history.xml) file'
- NAME = 'android_app_usage'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Android usage-history file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.asl module
The Apple System Log (ASL) file parser.
- class plaso.parsers.asl.ASLEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple System Log (ASL) event data.
- computer_name
name of the host.
- Type:
str
- extra_information
extra fields associated to the event.
- Type:
str
- facility
facility.
- Type:
str
- group_identifier
group identifier (GID).
- Type:
int
- level
level of criticality of the event.
- Type:
str
- message
message of the event.
- Type:
str
- message_identifier
message identifier.
- Type:
int
- process_identifier
process identifier (PID).
- Type:
int
- read_group_identifier
the group identifier that can read this file, where -1 represents all.
- Type:
int
- read_user_identifier
user identifier that can read this file, where -1 represents all.
- Type:
int
- record_position
position of the event record.
- Type:
int
- sender
sender or process that created the event.
- Type:
str
- user_identifier
user identifier (UID).
- Type:
int
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'macos:asl:entry'
- class plaso.parsers.asl.ASLFileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple System Log (ASL) file event data.
- creation_time
creation date and time.
- Type:
dfdatetime.DateTimeValues
- format_version
ASL file format version.
- Type:
int
- is_dirty
True if the last log entry offset does not match value in file header and the file is considered dirty.
- Type:
bool
- DATA_TYPE = 'macos:asl:file'
- class plaso.parsers.asl.ASLParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Apple System Log (ASL) files.
- DATA_FORMAT = 'Apple System Log (ASL) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'asl_log'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an ASL file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.bencode_parser module
Parser for bencoded files.
- class plaso.parsers.bencode_parser.BencodeFile[source]
Bases:
object
Bencode file.
- GetValues()[source]
Retrieves the values in the root of the bencode file.
- Returns:
values.
- Return type:
- IsEmpty()[source]
Determines if the bencode file has no values (is empty).
- Returns:
True if the bencode file is empty, False otherwise.
- Return type:
bool
- Open(file_object)[source]
Opens a bencode file.
- Parameters:
file_object (dfvfs.FileIO) – file-like object.
- Raises:
IOError – if the file-like object cannot be read.
OSError – if the file-like object cannot be read.
ValueError – if the file-like object is missing.
- property keys
names of all the keys.
- Type:
Set[str]
- class plaso.parsers.bencode_parser.BencodeParser[source]
Bases:
FileObjectParser
Parser for bencoded files.
- DATA_FORMAT = 'Bencoded file'
- NAME = 'bencode'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a bencoded file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.bencode_parser.BencodeValues(decoded_values)[source]
Bases:
object
Bencode values.
- GetDateTimeValue(name)[source]
Retrieves a date and time value.
- Parameters:
name (str) – name of the value.
- Returns:
date and time or None if not available.
- Return type:
dfdatetime.PosixTime
plaso.parsers.bodyfile module
Parser for the Sleuthkit (TSK) bodyfile format.
Sleuthkit version 3 format: MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime 0|/lost+found|11|d/drwx——|0|0|12288|1337961350|1337961350|1337961350|0
- More information about the format specifications can be read here:
- class plaso.parsers.bodyfile.BodyfileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Bodyfile event data.
- access_time
file entry last access date and time.
- Type:
dfdatetime.DateTimeValues
- change_time
file entry inode change (or metadata last modification) date and time.
- Type:
dfdatetime.DateTimeValues
- creation_time
file entry creation date and time.
- Type:
dfdatetime.DateTimeValues
- filename
name of the file.
- Type:
str
- group_identifier
group identifier (GID), equivalent to st_gid.
- Type:
int
- inode
“inode” of the file. Note that inode is an overloaded term in the context of a bodyfile and used for MFT entry index values as well.
- Type:
int
- md5
MD5 hash of the file content, formatted as a hexadecimal string.
- Type:
str
- mode_as_string
protection mode.
- Type:
str
- modification_time
file entry last modification date and time.
- Type:
dfdatetime.DateTimeValues
- offset
number of the corresponding line, from which the event data was extracted.
- Type:
int
- owner_identifier
user identifier (UID or SID) of the owner.
- Type:
str
- size
size of the file content.
- Type:
int
- symbolic_link_target
path of the symbolic link target.
- Type:
str
- DATA_TYPE = 'fs:bodyfile:entry'
- class plaso.parsers.bodyfile.BodyfileParser[source]
Bases:
FileObjectParser
SleuthKit bodyfile parser.
- DATA_FORMAT = 'SleuthKit version 3 bodyfile'
- NAME = 'bodyfile'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a bodyfile file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.bsm module
Basic Security Module (BSM) event auditing file parser.
- class plaso.parsers.bsm.BSMEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Basic Security Module (BSM) audit event data.
- event_type
identifier that represents the type of the event.
- Type:
int
- extra_tokens
event extra tokens, which is a list of dictionaries that contain: {token type: {token values}}
- Type:
list[dict[str, dict[str, str]]]
- offset
offset of the BSM record relative to the start of the file, from which the event data was extracted.
- Type:
int
- record_length
record length in bytes (trailer number).
- Type:
int
- return_value
processed return value and exit status.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'bsm:entry'
- class plaso.parsers.bsm.BSMParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Basic Security Module (BSM) event auditing files.
- DATA_FORMAT = 'Basic Security Module (BSM) event auditing file'
- NAME = 'bsm_log'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a BSM file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.chrome_cache module
Parser for Google Chrome and Chromium Cache files.
- class plaso.parsers.chrome_cache.CacheAddress(cache_address)[source]
Bases:
object
Chrome cache address.
- block_number
block data file number.
- Type:
int
- block_offset
offset within the block data file.
- Type:
int
- block_size
block size.
- Type:
int
- filename
name of the block data file.
- Type:
str
- value
cache address.
- Type:
int
- FILE_TYPE_BLOCK_1024 = 3
- FILE_TYPE_BLOCK_256 = 2
- FILE_TYPE_BLOCK_4096 = 4
- FILE_TYPE_BLOCK_RANKINGS = 1
- FILE_TYPE_SEPARATE = 0
- class plaso.parsers.chrome_cache.CacheEntry[source]
Bases:
object
Chrome cache entry.
- creation_time
creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.
- Type:
int
- hash
super fast hash of the key.
- Type:
int
- key
key.
- Type:
bytes
- next
cache address of the next cache entry.
- Type:
int
- original_url
original URL derived from the key.
- Type:
str
- rankings_node
cache address of the rankings node.
- Type:
int
- class plaso.parsers.chrome_cache.ChromeCacheDataBlockFileParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Chrome cache data block file parser.
- ParseCacheEntry(file_object, block_offset)[source]
Parses a cache entry.
- Parameters:
file_object (dfvfs.FileIO) – a file-like object to read from.
block_offset (int) – block offset of the cache entry.
- Returns:
cache entry.
- Return type:
- Raises:
ParseError – if the cache entry cannot be read.
- ParseFileObject(parser_mediator, file_object)[source]
Parses a file-like object.
- Parameters:
parser_mediator (ParserMediator) – a parser mediator.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises:
ParseError – when the file cannot be parsed.
- class plaso.parsers.chrome_cache.ChromeCacheEntryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome Cache event data.
- creation_time
creation date and time of the cache entry.
- Type:
dfdatetime.DateTimeValues
- original_url
original URL.
- Type:
str
- DATA_TYPE = 'chrome:cache:entry'
- class plaso.parsers.chrome_cache.ChromeCacheIndexFileParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Chrome cache index file parser.
- creation_time
creation time, in number of microseconds since January 1, 1601, 00:00:00 UTC.
- Type:
int
- index_table
the cache addresses which are stored in the index file.
- Type:
list[CacheAddress]
- ParseFileObject(parser_mediator, file_object)[source]
Parses a file-like object.
- Parameters:
parser_mediator (ParserMediator) – a parser mediator.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises:
ParseError – when the file cannot be parsed.
- class plaso.parsers.chrome_cache.ChromeCacheParser[source]
Bases:
FileEntryParser
Parses Chrome Cache files.
- DATA_FORMAT = 'Google Chrome or Chromium Cache file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'chrome_cache'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses Chrome Cache files.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – file entry.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.chrome_preferences module
A parser for the Chrome preferences file.
- class plaso.parsers.chrome_preferences.ChromeContentSettingsExceptionsEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome content settings exceptions event data.
- last_visited_time
date and time the URL was last visited.
- Type:
dfdatetime.DateTimeValues
- permission
permission.
- Type:
str
- primary_url
primary URL.
- Type:
str
- secondary_url
secondary URL.
- Type:
str
- DATA_TYPE = 'chrome:preferences:content_settings:exceptions'
- class plaso.parsers.chrome_preferences.ChromeExtensionInstallationEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome extension event data.
- extension_identifier
extension identifier.
- Type:
str
- extension_name
extension name.
- Type:
str
- installation_time
date and time the Chrome extension was installed.
- Type:
dfdatetime.DateTimeValues
- path
path.
- Type:
str
- DATA_TYPE = 'chrome:preferences:extension_installation'
- class plaso.parsers.chrome_preferences.ChromeExtensionsAutoupdaterEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Chrome Extension Autoupdater event data.
- message
message.
- Type:
str
- recorded_time
date and time the entry was recorded.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'chrome:preferences:extensions_autoupdater'
- class plaso.parsers.chrome_preferences.ChromePreferencesParser[source]
Bases:
FileObjectParser
Parses Chrome Preferences files.
- DATA_FORMAT = 'Google Chrome Preferences file'
- NAME = 'chrome_preferences'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Chrome preferences file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- REQUIRED_KEYS = frozenset({'browser', 'extensions'})
plaso.parsers.cups_ipp module
The CUPS IPP files parser.
CUPS IPP version 1.0: * https://datatracker.ietf.org/doc/html/rfc2565 * https://datatracker.ietf.org/doc/html/rfc2566 * https://datatracker.ietf.org/doc/html/rfc2567 * https://datatracker.ietf.org/doc/html/rfc2568 * https://datatracker.ietf.org/doc/html/rfc2569 * https://datatracker.ietf.org/doc/html/rfc2639
CUPS IPP version 1.1: * https://datatracker.ietf.org/doc/html/rfc2910 * https://datatracker.ietf.org/doc/html/rfc2911 * https://datatracker.ietf.org/doc/html/rfc3196 * https://datatracker.ietf.org/doc/html/rfc3510
CUPS IPP version 2.0: * N/A
- class plaso.parsers.cups_ipp.CupsIppEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
CUPS IPP event data.
- application
application that prints the document.
- Type:
str
- computer_name
name of the computer.
- Type:
str
- copies
number of copies.
- Type:
int
- creation_time
date and time the print job was created (added).
- Type:
dfdatetime.DateTimeValues
- doc_type
type of document.
- Type:
str
- end_time
date and time the print job was stopped.
- Type:
dfdatetime.DateTimeValues
- job_id
job identifier.
- Type:
str
- job_name
job name.
- Type:
str
- owner
real name of the user.
- Type:
str
- printer_id
identification name of the print.
- Type:
str
- start_time
date and time the print job was started.
- Type:
dfdatetime.DateTimeValues
- uri
URL of the CUPS service.
- Type:
str
- user
system user name.
- Type:
str
- DATA_TYPE = 'cups:ipp:event'
- class plaso.parsers.cups_ipp.CupsIppParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for CUPS IPP files.
- DATA_FORMAT = 'CUPS IPP file'
- NAME = 'cups_ipp'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a CUPS IPP file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.custom_destinations module
Parser for custom destinations jump list (.customDestinations-ms) files.
- class plaso.parsers.custom_destinations.CustomDestinationsParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses custom destinations jump list (.customDestinations-ms) files.
- DATA_FORMAT = 'Custom destinations jump list (.customDestinations-ms) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'custom_destinations'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a .customDestinations-ms file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.czip module
This file contains a parser for compound ZIP files.
- class plaso.parsers.czip.CompoundZIPParser[source]
Bases:
FileObjectParser
Shared functionality for parsing compound ZIP files.
Compound ZIP files are ZIP files used as containers to create another file format, as opposed to archives of unrelated files.
- DATA_FORMAT = 'Compound ZIP file'
- NAME = 'czip'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a compound ZIP file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.dsv_parser module
Delimiter separated values (DSV) parser interface.
- class plaso.parsers.dsv_parser.DSVParser[source]
Bases:
FileObjectParser
Delimiter separated values (DSV) parser interface.
- COLUMNS = []
- DELIMITER = ','
- ESCAPE_CHARACTER = ''
- FIELD_SIZE_LIMIT = 131072
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NUMBER_OF_HEADER_LINES = 0
- ParseFileObject(parser_mediator, file_object)[source]
Parses a DSV text file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- abstract ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- QUOTE_CHAR = '"'
- abstract VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
plaso.parsers.esedb module
Parser for Extensible Storage Engine (ESE) database files (EDB).
- class plaso.parsers.esedb.ESEDBCache[source]
Bases:
BasePluginCache
A cache storing query results for ESEDB plugins.
- class plaso.parsers.esedb.ESEDBParser[source]
Bases:
FileObjectParser
Parses Extensible Storage Engine (ESE) database files (EDB).
- DATA_FORMAT = 'Extensible Storage Engine (ESE) Database File (EDB) format'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'esedb'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an ESE database file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- class plaso.parsers.esedb.ESEDatabase[source]
Bases:
object
Extensible Storage Engine (ESE) database.
- GetTableByName(name)[source]
Retrieves a table by its name.
- Parameters:
name (str) – name of the table.
- Returns:
- the table with the corresponding name or None if there is
no table with the name.
- Return type:
pyesedb.table
- Open(file_object)[source]
Opens an Extensible Storage Engine (ESE) database file.
- Parameters:
file_object (dfvfs.FileIO) – file-like object.
- Raises:
IOError – if the file-like object cannot be read.
OSError – if the file-like object cannot be read.
ValueError – if the file-like object is missing.
- property tables
names of all the tables.
- Type:
List[str]
plaso.parsers.filestat module
File system stat object parser.
- class plaso.parsers.filestat.FileStatEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
File system stat event data.
- access_time
file entry last access date and time.
- Type:
dfdatetime.DateTimeValues
- added_time
file entry added date and time.
- Type:
dfdatetime.DateTimeValues
- attribute_names
extended attribute names.
- Type:
[str]
- backup_time
file entry backup date and time.
- Type:
dfdatetime.DateTimeValues
- change_time
file entry inode change (or metadata last modification) date and time.
- Type:
dfdatetime.DateTimeValues
- creation_time
file entry creation date and time.
- Type:
dfdatetime.DateTimeValues
- deletion_time
file entry deletion date and time.
- Type:
dfdatetime.DateTimeValues
- display_name
display name.
- Type:
str
- file_entry_type
dfVFS file entry type.
- Type:
int
- file_size
file size in bytes.
- Type:
int
- file_system_type
file system type.
- Type:
str
- filename
name of the file.
- Type:
str
- group_identifier
group identifier (GID), equivalent to st_gid.
- Type:
int
- inode
inode of the file.
- Type:
int
- is_allocated
True if the file is allocated.
- Type:
bool
- mode
access mode, equivalent to st_mode & 0x0fff.
- Type:
int
- modification_time
file entry last modification date and time.
- Type:
dfdatetime.DateTimeValues
- number_of_links
number of hard links, equivalent to st_nlink.
- Type:
int
- owner_identifier
user identifier (UID) of the owner, equivalent to st_uid.
- Type:
int
- DATA_TYPE = 'fs:stat'
- class plaso.parsers.filestat.FileStatParser[source]
Bases:
FileEntryParser
Parses file system stat object.
- DATA_FORMAT = 'file system stat information'
- NAME = 'filestat'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses a file entry.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – a file entry.
plaso.parsers.firefox_cache module
Implements a parser for Firefox cache 1 and 2 files.
- class plaso.parsers.firefox_cache.BaseFirefoxCacheParser[source]
Bases:
FileObjectParser
Parses Firefox cache files.
- class plaso.parsers.firefox_cache.FirefoxCache2Parser[source]
Bases:
BaseFirefoxCacheParser
,DtFabricHelper
Parses Firefox cache version 2 files (Firefox 32 or later).
- DATA_FORMAT = 'Mozilla Firefox Cache version 2 file (version 32 or later)'
- NAME = 'firefox_cache2'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Firefox cache file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.firefox_cache.FirefoxCacheEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Firefox cache event data.
- data_size
size of the cached data.
- Type:
int
- expiration_time
date and time the cache entry expires.
- Type:
dfdatetime.DateTimeValues
- fetch_count
number of times the cache entry was fetched.
- Type:
int
- frequency
???
- Type:
int
- info_size
size of the metadata.
- Type:
int
- last_fetched_time
date and time the cache entry was last fetched.
- Type:
dfdatetime.DateTimeValues
- last_modified_time
date and time the cache entry was last modified.
- Type:
dfdatetime.DateTimeValues
- location
???
- Type:
str
- request_method
HTTP request method.
- Type:
str
- request_size
HTTP request byte size.
- Type:
int
- response_code
HTTP response code.
- Type:
int
- url
URL of original content.
- Type:
str
- version
cache format version.
- Type:
str
- DATA_TYPE = 'firefox:cache:record'
- class plaso.parsers.firefox_cache.FirefoxCacheParser[source]
Bases:
BaseFirefoxCacheParser
,DtFabricHelper
Parses Firefox cache version 1 files (Firefox 31 or earlier).
- DATA_FORMAT = 'Mozilla Firefox Cache version 1 file (version 31 or earlier)'
- FIREFOX_CACHE_CONFIG
alias of
firefox_cache_config
- NAME = 'firefox_cache'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Firefox cache file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.fish_history module
Parser for fish history files.
- class plaso.parsers.fish_history.FishHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Fish history log event data.
- command
command that was executed.
- Type:
str
- written_time
date and time the entry was written.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'fish:history:entry'
- class plaso.parsers.fish_history.FishHistoryParser[source]
Bases:
FileObjectParser
Parses events from Fish history files.
- DATA_FORMAT = 'Fish history file'
- NAME = 'fish_history'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a fish history file from a file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.fseventsd module
Parsers for MacOS fseventsd files.
- class plaso.parsers.fseventsd.FseventsdEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS file system event (fseventsd) event data.
- event_identifier
the record event identifier.
- Type:
int
- file_entry_modification_time
file entry last modification date and time.
- Type:
dfdatetime.DateTimeValues
- flags
flags stored in the record.
- Type:
int
- node_identifier
file system node identifier related to the file system event.
- Type:
int
- path
path recorded in the fseventsd record.
- Type:
str
- DATA_TYPE = 'macos:fseventsd:record'
- class plaso.parsers.fseventsd.FseventsdParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for fseventsd files.
This parser supports both version 1 and version 2 fseventsd files.
- DATA_FORMAT = 'MacOS File System Events Disk Log Stream (fseventsd) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'fseventsd'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an fseventsd file.
- Parameters:
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the header cannot be parsed.
plaso.parsers.interface module
The parsers and plugins interface classes.
- class plaso.parsers.interface.BaseFileEntryFilter[source]
Bases:
object
File entry filter interface.
- class plaso.parsers.interface.BaseParser[source]
Bases:
object
The parser interface.
- ALL_PLUGINS = {'*'}
- DATA_FORMAT = ''
- classmethod DeregisterPlugin(plugin_class)[source]
Deregisters a plugin class.
The plugin classes are identified based on their lower case name.
- Parameters:
plugin_class (type) – class of the plugin.
- Raises:
KeyError – if plugin class is not set for the corresponding name.
- EnablePlugins(plugin_includes)[source]
Enables parser plugins.
- Parameters:
plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.
- FILTERS = frozenset({})
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
a format specification or None if not available.
- Return type:
- classmethod GetPluginNames()[source]
Retrieves the names of registered plugins.
- Returns:
names of the plugins.
- Return type:
list[str]
- classmethod GetPluginObjectByName(plugin_name)[source]
Retrieves a specific plugin object by its name.
- Parameters:
plugin_name (str) – name of the plugin.
- Returns:
a plugin object or None if not available.
- Return type:
- classmethod GetPlugins()[source]
Retrieves the registered plugins.
- Yields:
tuple[str, type] – name and class of the plugin.
- NAME = 'base_parser'
- classmethod RegisterPlugin(plugin_class)[source]
Registers a plugin class.
The plugin classes are identified based on their lower case name.
- Parameters:
plugin_class (type) – class of the plugin.
- Raises:
KeyError – if plugin class is already set for the corresponding name.
- classmethod RegisterPlugins(plugin_classes)[source]
Registers plugin classes.
- Parameters:
plugin_classes (list[type]) – classes of plugins.
- Raises:
KeyError – if plugin class is already set for the corresponding name.
- classmethod SupportsPlugins()[source]
Determines if a parser supports plugins.
- Returns:
True if the parser supports plugins.
- Return type:
bool
- __init__()[source]
Initializes a parser.
By default all plugins will be enabled. To only enable specific plugins use the EnablePlugins method and pass it a list of strings containing the names of the plugins to enable.
The default plugin, named “{self.NAME:s}_default”, if it exists, is always enabled and cannot be disabled.
- class plaso.parsers.interface.FileEntryParser[source]
Bases:
BaseParser
The file entry parser interface.
- Parse(parser_mediator)[source]
Parses a file entry.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
- Raises:
WrongParser – when the file cannot be parsed.
- abstract ParseFileEntry(parser_mediator, file_entry)[source]
Parses a file entry.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – a file entry to parse.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.interface.FileNameFileEntryFilter(filename)[source]
Bases:
BaseFileEntryFilter
File name file entry filter.
- class plaso.parsers.interface.FileObjectParser[source]
Bases:
BaseParser
The file-like object parser interface.
- Parse(parser_mediator, file_object)[source]
Parses a single file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises:
WrongParser – when the file cannot be parsed.
- abstract ParseFileObject(parser_mediator, file_object)[source]
Parses a file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.java_idx module
Parser for Java Cache IDX files.
- class plaso.parsers.java_idx.JavaIDXEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Java IDX cache file event data.
- downloaded_time
date and time the content was downloaded.
- Type:
dfdatetime.DateTimeValues
- expiration_time
date and time the cached download expires.
- Type:
dfdatetime.DateTimeValues
- idx_version
format version of IDX file.
- Type:
str
- ip_address
IP address of the host in the URL.
- Type:
str
- modification_time
date and time the cached download expires.
- Type:
dfdatetime.DateTimeValues
- url
URL of the downloaded file.
- Type:
str
- DATA_TYPE = 'java:download:idx'
- class plaso.parsers.java_idx.JavaIDXParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Java WebStart Cache IDX files.
There are five structures defined. 6.02 files had one generic section that retained all data. From 6.03, the file went to a multi-section format where later sections were optional and had variable-lengths. 6.03, 6.04, and 6.05 files all have their main data section (#2) begin at offset 128. The short structure is because 6.05 files deviate after the 8th byte. So, grab the first 8 bytes to ensure it’s valid, get the file version, then continue on with the correct structures.
- DATA_FORMAT = 'Java WebStart Cache IDX file'
- NAME = 'java_idx'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Java WebStart Cache IDX file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object to parse.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.jsonl_parser module
Base parser for line-based JSON (JSON-L) log formats.
- class plaso.parsers.jsonl_parser.JSONLParser[source]
Bases:
FileObjectParser
Base parser for line-based JSON (JSON-L) log formats.
- DATA_FORMAT = 'JSON-L log file'
- NAME = 'jsonl'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a line-based JSON (JSON-L) log file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.locate module
Parser for locate database (updatedb) files.
- class plaso.parsers.locate.LocateDatabaseEvent(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Linux locate database (updatedb) event data.
- entries
contents of the locate database (updatedb) entry.
- Type:
list[str]
- path
path of the locate database (updatedb) entry.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'linux:locate_database:entry'
- class plaso.parsers.locate.LocateDatabaseParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for locate database (updatedb) files.
- DATA_FORMAT = 'Locate database file (updatedb)'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'locate_database'
- ParseFileObject(parser_mediator, file_object, **kwargs)[source]
Parses a locate database (updatedb) file-like object.
- Parameters:
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – file-like object to be parsed.
- Raises:
WrongParser – when the file cannot be parsed, this will signal the event extractor to apply other parsers.
plaso.parsers.logger module
The parsers sub module logger.
plaso.parsers.macos_keychain module
Parser for MacOS keychain database files.
- class plaso.parsers.macos_keychain.KeychainApplicationRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS keychain application password record event data.
- account_name
name of the account.
- Type:
str
- comments
comments added by the user.
- Type:
str
- creation_time
creation date and time of the keychain record.
- Type:
dfdatetime.DateTimeValues
- entry_name
name of the entry.
- Type:
str
- modification_time
modification date and time of the keychain record.
- Type:
dfdatetime.DateTimeValues
- ssgp_hash
password/certificate hash formatted as a hexadecimal string.
- Type:
str
- text_description
description.
- Type:
str
- DATA_TYPE = 'macos:keychain:application'
- class plaso.parsers.macos_keychain.KeychainDatabaseColumn[source]
Bases:
object
MacOS keychain database column.
- attribute_data_type
attribute (data) type.
- Type:
int
- attribute_identifier
attribute identifier.
- Type:
int
- attribute_name
attribute name.
- Type:
str
- class plaso.parsers.macos_keychain.KeychainDatabaseTable[source]
Bases:
object
MacOS keychain database table.
- columns
columns.
- Type:
list[KeychainDatabaseColumn]
- records
records.
- Type:
list[dict[str, str]]
- relation_identifier
relation identifier.
- Type:
int
- relation_name
relation name.
- Type:
str
- class plaso.parsers.macos_keychain.KeychainInternetRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS keychain internet record event data.
- account_name
name of the account.
- Type:
str
- comments
comments added by the user.
- Type:
str
- creation_time
creation date and time of the keychain record.
- Type:
dfdatetime.DateTimeValues
- entry_name
name of the entry.
- Type:
str
- modification_time
modification date and time of the keychain record.
- Type:
dfdatetime.DateTimeValues
- protocol
internet protocol used, for example “https”.
- Type:
str
- ssgp_hash
password/certificate hash formatted as a hexadecimal string.
- Type:
str
- text_description
description.
- Type:
str
- type_protocol
sub-protocol used, for example “form”.
- Type:
str
- where
domain name or IP where the password is used.
- Type:
str
- DATA_TYPE = 'macos:keychain:internet'
- class plaso.parsers.macos_keychain.KeychainParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for MacOS keychain database files.
- DATA_FORMAT = 'MacOS keychain database file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'mac_keychain'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a MacOS keychain file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.manager module
The parsers and plugins manager.
- class plaso.parsers.manager.ParsersManager[source]
Bases:
object
The parsers and plugins manager.
- ALL_PLUGINS = {'*'}
- classmethod CheckFilterExpression(parser_filter_expression)[source]
Checks parser and plugin names in a parser filter expression.
- Parameters:
parser_filter_expression (str) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns:
containing:
- set(str): parser filter expression elements that contain known parser
and/or plugin names.
- set(str): parser filter expression elements that contain unknown parser
and/or plugin names.
- Return type:
tuple
- classmethod CreateSignatureScanner(specification_store)[source]
Creates a signature scanner for format specifications with signatures.
- Parameters:
specification_store (FormatSpecificationStore) – format specifications with signatures.
- Returns:
signature scanner.
- Return type:
pysigscan.scanner
- classmethod DeregisterParser(parser_class)[source]
Deregisters a parser class.
The parser classes are identified based on their lower case name.
- Parameters:
parser_class (type) – parser class (subclass of BaseParser).
- Raises:
KeyError – if parser class is not set for the corresponding name.
- classmethod GetFormatsWithSignatures(parser_filter_expression=None)[source]
Retrieves the format specifications that have signatures.
This method will create a specification store for parsers that define a format specification with signatures and a list of parser names for those that do not.
- Parameters:
parser_filter_expression (Optional[str]) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns:
containing:
FormatSpecificationStore: format specifications with signatures.
- list[str]: names of parsers that do not have format specifications with
signatures, or have signatures but also need to be applied ‘brute force’.
- Return type:
tuple
- classmethod GetNamesOfParsersWithPlugins()[source]
Retrieves the names of all parsers with plugins.
- Returns:
names of all parsers with plugins.
- Return type:
list[str]
- classmethod GetParserObjects(parser_filter_expression=None)[source]
Retrieves the parser objects.
- Parameters:
parser_filter_expression (Optional[str]) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns:
parsers per name.
- Return type:
dict[str, BaseParser]
- classmethod GetParserPluginsInformation(parser_filter_expression=None)[source]
Retrieves the parser plugins information.
- Parameters:
parser_filter_expression (Optional[str]) –
parser filter expression, where None represents all parsers and plugins.
A parser filter expression is a comma separated value string that denotes which parsers and plugins should be used. See filters/parser_filter.py for details of the expression syntax.
This function does not support presets, and requires a parser filter expression where presets have been expanded.
- Returns:
pairs of parser plugin names and descriptions.
- Return type:
list[tuple[str, str]]
- classmethod GetParsersInformation()[source]
Retrieves the parsers information.
- Returns:
parser names and descriptions.
- Return type:
list[tuple[str, str]]
- classmethod RegisterParser(parser_class)[source]
Registers a parser class.
The parser classes are identified based on their lower case name.
- Parameters:
parser_class (type) – parser class (subclass of BaseParser).
- Raises:
KeyError – if parser class is already set for the corresponding name.
- classmethod RegisterParsers(parser_classes)[source]
Registers parser classes.
The parser classes are identified based on their lower case name.
- Parameters:
parser_classes (list[type]) – parsers classes (subclasses of BaseParser).
- Raises:
KeyError – if parser class is already set for the corresponding name.
plaso.parsers.mcafeeav module
Parser for McAfee Anti-Virus Logs.
McAfee AV uses 4 logs to track when scans were run, when virus databases were updated, and when files match the virus database.
- class plaso.parsers.mcafeeav.McafeeAVEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
McAfee AV Log event data.
- action
action.
- Type:
str
- filename
filename.
- Type:
str
- offset
offset of the line relative to the start of the file, from which the event data was extracted.
- Type:
int
- rule
rule.
- Type:
str
- status
status.
- Type:
str
- trigger_location
trigger location.
- Type:
str
- username
username.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'av:mcafee:accessprotectionlog'
- class plaso.parsers.mcafeeav.McafeeAccessProtectionParser[source]
Bases:
DSVParser
Parses the McAfee AV Access Protection Log.
- COLUMNS = ['date', 'time', 'status', 'username', 'filename', 'trigger_location', 'rule', 'action']
- DATA_FORMAT = 'McAfee Anti-Virus access protection log file'
- DELIMITER = '\t'
- NAME = 'mcafee_protection'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
plaso.parsers.mediator module
The parser mediator.
- class plaso.parsers.mediator.ParserMediator(registry_find_specs=None, resolver_context=None, system_configurations=None)[source]
Bases:
object
Parser mediator.
- last_activity_timestamp
timestamp received that indicates the last time activity was observed. The last activity timestamp is updated when the mediator produces an attribute container, such as an event source. This timestamp is used by the multi processing worker process to indicate the last time the worker was known to be active. This information is then used by the foreman to detect workers that are not responding (stalled).
- Type:
int
- parsers_counter
number of events per parser or parser plugin.
- Type:
collections.Counter
- registry_find_specs
Windows Registry find specifications.
- Type:
list[dfwinreg.FindSpec]
- AddDateLessLogHelper(date_less_log_helper)[source]
Adds a date-less log helper.
- Parameters:
date_less_log_helper (DateLessLogHelper) – date-less log helper.
- AddWindowsEventLogMessageFile(message_file)[source]
Adds a Windows EventLog message file.
- Parameters:
message_file (WindowsEventLogMessageFileArtifact) – Windows EventLog message file.
- AddWindowsEventLogMessageString(message_string)[source]
Adds a Windows EventLog message string.
- Parameters:
message_string (WindowsEventLogMessageStringArtifact) – Windows EventLog message string.
- AddWindowsWevtTemplateEvent(event_definition)[source]
Adds a Windows WEVT_TEMPLATE event definition.
- Parameters:
event_definition (WindowsWevtTemplateEvent) – Windows WEVT_TEMPLATE event definition.
- AppendToParserChain(name)[source]
Adds a parser or parser plugin to the parser chain.
- Parameters:
name (str) – name of a parser or parser plugin.
- ExpandWindowsPath(path)[source]
Expands a Windows path containing environment variables.
- Parameters:
path (str) – Windows path with environment variables.
- Returns:
expanded Windows path.
- Return type:
str
- GetCodePage()[source]
Retrieves the code page related to the file entry.
- Returns:
code page.
- Return type:
str
- GetDisplayName(file_entry=None)[source]
Retrieves the display name for a file entry.
- Parameters:
file_entry (Optional[dfvfs.FileEntry]) – file entry object, where None will use the active file entry.
- Returns:
human readable string that describes the path to the file entry.
- Return type:
str
- Raises:
ValueError – if the file entry is missing.
- GetDisplayNameForPathSpec(path_spec)[source]
Retrieves the display name for a path specification.
- Parameters:
path_spec (dfvfs.PathSpec) – path specification.
- Returns:
human readable version of the path specification.
- Return type:
str
- GetFileEntry()[source]
Retrieves the active file entry.
- Returns:
file entry or None if not available.
- Return type:
dfvfs.FileEntry
- GetFilename()[source]
Retrieves the name of the active file entry.
- Returns:
name of the active file entry or None.
- Return type:
str
- GetLanguageTag()[source]
Retrieves the language tag related to the file entry.
- Returns:
code page.
- Return type:
str
- GetParserChain()[source]
Retrieves the current parser chain.
- Returns:
parser chain.
- Return type:
str
- GetRelativePath()[source]
Retrieves the relative path of the current file entry.
- Returns:
- relative path of the current file entry or None if no current
file entry.
- Return type:
str
- GetRelativePathForPathSpec(path_spec)[source]
Retrieves the relative path for a path specification.
- Parameters:
path_spec (dfvfs.PathSpec) – path specification.
- Returns:
relative path of the path specification.
- Return type:
str
- GetWindowsEventLogMessageFile()[source]
Retrieves the Windows EventLog message file for a specific path.
- Returns:
- Windows EventLog message file or None
if no current file entry or no Windows EventLog message file was found.
- Return type:
- ProduceEventData(event_data)[source]
Produces event data.
- Parameters:
event_data (EventData) – event data.
- Raises:
RuntimeError – when storage writer is not set.
- ProduceEventDataStream(event_data_stream)[source]
Produces an event data stream.
- Parameters:
event_data_stream (EventDataStream) – an event data stream or None if no event data stream is needed.
- Raises:
RuntimeError – when storage writer is not set.
- ProduceEventSource(event_source)[source]
Produces an event source.
- Parameters:
event_source (EventSource) – an event source.
- Raises:
RuntimeError – when storage writer is not set.
- ProduceExtractionWarning(message, path_spec=None)[source]
Produces an extraction warning.
- Parameters:
message (str) – message of the warning.
path_spec (Optional[dfvfs.PathSpec]) – path specification, where None will use the path specification of current file entry set in the mediator.
- Raises:
RuntimeError – when storage writer is not set.
- ProduceRecoveryWarning(message, path_spec=None)[source]
Produces a recovery warning.
- Parameters:
message (str) – message of the warning.
path_spec (Optional[dfvfs.PathSpec]) – path specification, where None will use the path specification of current file entry set in the mediator.
- Raises:
RuntimeError – when storage writer is not set.
- SampleFormatCheckStartTiming(parser_name)[source]
Starts timing a CPU time sample for profiling.
- Parameters:
parser_name (str) – name of the parser.
- SampleFormatCheckStopTiming(parser_name)[source]
Stops timing a CPU time sample for profiling.
- Parameters:
parser_name (str) – name of the parser.
- SampleMemoryUsage(parser_name)[source]
Takes a sample of the memory usage for profiling.
- Parameters:
parser_name (str) – name of the parser.
- SampleStartTiming(parser_name)[source]
Starts timing a CPU time sample for profiling.
- Parameters:
parser_name (str) – name of the parser.
- SampleStopTiming(parser_name)[source]
Stops timing a CPU time sample for profiling.
- Parameters:
parser_name (str) – name of the parser.
- SetExtractWinEvtResources(extract_winevt_resources)[source]
Sets value to extract Windows EventLog resources.
- Parameters:
extract_winevt_resources (bool) – True if Windows EventLog resources should be extracted.
- SetExtractWinRegBinaryValues(extract_winreg_binary_values)[source]
Sets value to extract Windows Registry binary values.
- Parameters:
extract_winreg_binary_values (bool) – True if Windows Registry binary values should be extracted.
- SetFileEntry(file_entry)[source]
Sets the active file entry.
- Parameters:
file_entry (dfvfs.FileEntry) – file entry.
- SetPreferredCodepage(code_page)[source]
Sets the preferred code page.
- Parameters:
code_page (str) – code page.
- SetPreferredLanguage(language_tag)[source]
Sets the preferred language.
- Parameters:
language_tag (str) – language tag such as “en-US” for US English or “is-IS” for Icelandic or None if the language determined by preprocessing or the default should be used.
- Raises:
ValueError – if the language tag is not a string type or no LCID can be determined that corresponds with the language tag.
- SetStorageWriter(storage_writer)[source]
Sets the storage writer.
- Parameters:
storage_writer (StorageWriter) – storage writer.
- SetTemporaryDirectory(temporary_directory)[source]
Sets the directory to store temporary files.
- Parameters:
temporary_directory (str) – path of the directory to store temporary files.
- SetWindowsEventLogProviders(windows_event_log_providers)[source]
Sets the Windows EventLog providers.
- Rags:
- windows_event_log_providers (list[WindowsEventLogProviderArtifact]):
Windows EventLog providers.
- StartProfiling(configuration, identifier, process_information)[source]
Starts profiling.
- Parameters:
configuration (ProfilingConfiguration) – profiling configuration.
identifier (str) – identifier of the profiling session used to create the sample filename.
process_information (ProcessInfo) – process information.
- __init__(registry_find_specs=None, resolver_context=None, system_configurations=None)[source]
Initializes a parser mediator.
- Parameters:
registry_find_specs (Optional[list[dfwinreg.FindSpec]]) – Windows Registry find specifications.
resolver_context (Optional[dfvfs.Context]) – resolver context.
system_configurations (Optional[list[SystemConfigurationArtifact]]) – system configurations.
- property abort
True if parsing should be aborted.
- Type:
bool
- property extract_winevt_resources
extract Windows EventLog resources.
- Type:
bool
- property extract_winreg_binary_values
extract Windows Registry binary values.
- Type:
bool
- property number_of_produced_event_data
number of produced event data.
- Type:
int
- property number_of_produced_event_sources
number of produced event sources.
- Type:
int
- property number_of_produced_extraction_warnings
number of produced extraction warnings.
- Type:
int
- property resolver_context
resolver context.
- Type:
dfvfs.Context
- property temporary_directory
path of the directory for temporary files.
- Type:
str
plaso.parsers.msiecf module
Parser for Microsoft Internet Explorer (MSIE) Cache Files (CF).
- class plaso.parsers.msiecf.MSIECFLeakEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIECF leak event data.
- cached_filename
name of the cached file.
- Type:
str
- cached_file_size
size of the cached file.
- Type:
int
- cache_directory_index
index of the cache directory.
- Type:
int
- cache_directory_name
name of the cache directory.
- Type:
str
- offset
offset of the MSIECF item relative to the start of the file, from which the event data was extracted.
- Type:
int
- recovered
True if the item was recovered.
- Type:
bool
- DATA_TYPE = 'msiecf:leak'
- class plaso.parsers.msiecf.MSIECFParser[source]
Bases:
FileObjectParser
Parses MSIE Cache Files (MSIECF).
- DATA_FORMAT = 'Microsoft Internet Explorer (MSIE) 4 - 9 cache (index.dat) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'msiecf'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a MSIE Cache File (MSIECF) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- class plaso.parsers.msiecf.MSIECFRedirectedEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIECF redirected event data.
- offset
offset of the MSIECF item relative to the start of the file, from which the event data was extracted.
- Type:
int
- recovered
True if the item was recovered.
- Type:
bool
- url
location URL.
- Type:
str
- DATA_TYPE = 'msiecf:redirected'
- class plaso.parsers.msiecf.MSIECFURLEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MSIECF URL event data.
- access_time
date and time the MSIECF item was last accessed.
- Type:
dfdatetime.DateTimeValues
- cached_filename
name of the cached file.
- Type:
str
- cached_file_size
size of the cached file.
- Type:
int
- cache_directory_index
index of the cache directory.
- Type:
int
- cache_directory_name
name of the cache directory.
- Type:
str
- creation_time
date and time the MSIECF item was created.
- Type:
dfdatetime.DateTimeValues
- expiration_time
date and time the MSIECF item expires.
- Type:
dfdatetime.DateTimeValues
- http_headers
HTTP headers.
- Type:
str
- modification_time
date and time the MSIECF item was last modified.
- Type:
dfdatetime.DateTimeValues
- last_visited_time
date and time the MSIECF item was last visited.
- Type:
dfdatetime.DateTimeValues
- number_of_hits
number of hits.
- Type:
int
- offset
offset of the MSIECF item relative to the start of the file, from which the event data was extracted.
- Type:
int
- primary_time
unspecified primary date and time of the MSIECF item.
- Type:
dfdatetime.DateTimeValues
- recovered
True if the item was recovered.
- Type:
bool
- secondary_time
unspecified secondary date and time of the MSIECF item.
- Type:
dfdatetime.DateTimeValues
- synchronization_time
synchronization date and time.
- Type:
dfdatetime.DateTimeValues
- url
location URL.
- Type:
str
- DATA_TYPE = 'msiecf:url'
plaso.parsers.networkminer module
Parser for NetworkMiner .fileinfos files.
- class plaso.parsers.networkminer.NetworkMinerEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
NetworkMiner event Data.
- destination_ip
Destination IP address.
- Type:
str
- destination_port
Destination port number.
- Type:
str
- file_details
Details about the file.
- Type:
string
- file_md5
MD5 hash of the file.
- Type:
string
- file_path
File path to where it was downloaded.
- Type:
string
- file_size
Size of the file.
- Type:
string
- filename
Name of the file.
- Type:
string
- source_ip
Originating IP address.
- Type:
str
- source_port
Originating port number.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'networkminer:fileinfos:file'
- class plaso.parsers.networkminer.NetworkMinerParser[source]
Bases:
DSVParser
Parser for NetworkMiner .fileinfos files.
- COLUMNS = ('source_ip', 'source_port', 'destination_ip', 'destination_port', 'filename', 'file_path', 'file_size', 'unused', 'file_md5', 'unused2', 'file_details', 'unused4', 'timestamp')
- DATA_FORMAT = 'NetworkMiner .fileinfos file'
- NAME = 'networkminer_fileinfo'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row_offset (int) – line number of the row.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
plaso.parsers.ntfs module
Parser for NTFS metadata files.
- class plaso.parsers.ntfs.NTFSFileStatEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
NTFS file system stat event data.
- access_time
file entry last access date and time.
- Type:
dfdatetime.DateTimeValues
- attribute_type
attribute type for example “0x00000030”, which represents “$FILE_NAME”.
- Type:
int
- creation_time
file entry creation date and time.
- Type:
dfdatetime.DateTimeValues
- display_name
display name.
- Type:
str
- entry_modification_time
file entry modification date and time.
- Type:
dfdatetime.DateTimeValues
- file_attribute_flags
NTFS file attribute flags.
- Type:
int
- file_reference
NTFS file reference.
- Type:
int
- file_system_type
file system type.
- Type:
str
- filename
name of the file.
- Type:
str
- is_allocated
True if the MFT entry is allocated (marked as in use).
- Type:
bool
- modification_time
file entry last modification date and time.
- Type:
dfdatetime.DateTimeValues
- name
name associated with the stat event, for example that of a $FILE_NAME attribute or None if not available.
- Type:
str
- parent_file_reference
NTFS file reference of the parent.
- Type:
int
- path_hints
hints about the full path of the file.
- Type:
list[str]
- symbolic_link_target
path of the symbolic link target.
- Type:
str
- DATA_TYPE = 'fs:stat:ntfs'
- class plaso.parsers.ntfs.NTFSMFTParser[source]
Bases:
FileObjectParser
Parses a NTFS $MFT metadata file.
- DATA_FORMAT = 'NTFS $MFT metadata file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'mft'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a NTFS $MFT metadata file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- class plaso.parsers.ntfs.NTFSUSNChangeEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
NTFS USN change event data.
- file_attribute_flags
NTFS file attribute flags.
- Type:
int
- filename
name of the file associated with the event.
- Type:
str
- file_reference
NTFS file reference.
- Type:
int
- file_system_type
file system type.
- Type:
str
- parent_file_reference
NTFS file reference of the parent.
- Type:
int
- offset
offset of the USN record relative to the start of the $J data stream, from which the event data was extracted.
- Type:
int
- update_reason_flags
update reason flags.
- Type:
int
- update_sequence_number
update sequence number.
- Type:
int
- update_source_flags
update source flags.
- Type:
int
- update_time
update date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'fs:ntfs:usn_change'
- class plaso.parsers.ntfs.NTFSUsnJrnlParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses a NTFS USN change journal.
- DATA_FORMAT = 'NTFS USN change journal ($UsnJrnl:$J) file system metadata file'
- NAME = 'usnjrnl'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a NTFS $UsnJrnl metadata file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.olecf module
Parser for OLE Compound Files (OLECF).
- class plaso.parsers.olecf.OLECFParser[source]
Bases:
FileObjectParser
Parses OLE Compound Files (OLECF).
- DATA_FORMAT = 'OLE Compound File (OLECF) format'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'olecf'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an OLE Compound File (OLECF) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.onedrive module
Parser for OneDrive Log (ODL/ODLGZ) files.
Reference: https://forensics.wiki/microsoft_onedrive/
- class plaso.parsers.onedrive.OneDriveLogEvent(*args: Any, **kwargs: Any)[source]
Bases:
EventData
OneDrive log event data.
- code_filename
code filename.
- Type:
str
- code_function_name
code function name.
- Type:
str
- decoded_parameters
decoded (and decrypted) parameters.
- Type:
str
- raw_parameters
the raw parameters encoded as a hexadecimal formatted string.
- Type:
str
- recorded_time
date and time the entry was recorded.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:onedrive:log'
- class plaso.parsers.onedrive.OneDriveLogFileParser[source]
Bases:
FileEntryParser
,DtFabricHelper
Parser for OneDrive log files.
- BLOCK_SIGNATURE = b'\xcc\xdd\xee\xff\x00\x00\x00\x00'
- COMPRESSED_BLOCK_SIGNATURE = b'\x1f\x8b\x08\x00\x00\x00\x00\x00'
- DATA_FORMAT = 'OneDrive Log file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'onedrive_log'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses a OneDrive Log file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – file entry.
- Raises:
ParseError – when a log cannot be decompressed.
WrongParser – when the file cannot be parsed.
plaso.parsers.opera module
Parsers for Opera Browser history files.
- class plaso.parsers.opera.OperaGlobalHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Opera global history entry data.
- description
description.
- Type:
str
- last_visited_time
date and time the URL was last visited.
- Type:
dfdatetime.DateTimeValues
- popularity_index
popularity index.
- Type:
int
- title
title.
- Type:
str
- url
URL.
- Type:
str
- DATA_TYPE = 'opera:history:entry'
- class plaso.parsers.opera.OperaGlobalHistoryParser[source]
Bases:
FileObjectParser
Parses the Opera global_history.dat file.
- DATA_FORMAT = 'Opera global history (global_history.dat) file'
- NAME = 'opera_global'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Opera global history file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.opera.OperaTypedHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Opera typed history entry data.
- entry_selection
information about whether the URL was directly typed in or the result of the user choosing from the auto complete.
- Type:
str
- entry_type
information about whether the URL was directly typed in or the result of the user choosing from the auto complete.
- Type:
str
- last_typed_time
date and time the URL was last typed.
- Type:
dfdatetime.DateTimeValues
- url
typed URL or hostname.
- Type:
str
- DATA_TYPE = 'opera:history:typed_entry'
- class plaso.parsers.opera.OperaTypedHistoryParser[source]
Bases:
FileObjectParser
Parses the Opera typed_history.xml file.
- DATA_FORMAT = 'Opera typed history (typed_history.xml) file'
- NAME = 'opera_typed_history'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an Opera typed history file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.pe module
A parser for Portable Executable (PE) files.
- class plaso.parsers.pe.PEDLLImportEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Portable Executable (PE) DLL import event data.
- delayed_import
True if the DLL is imported at run-time.
- Type:
bool
- modification_time
last modification date and time.
- Type:
dfdatetime.DateTimeValues
- name
name of the imported DLL.
- Type:
str
- DATA_TYPE = 'pe_coff:dll_import'
- class plaso.parsers.pe.PEFileEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Portable Executable (PE) file event data.
- creation_time
creation date and time.
- Type:
dfdatetime.DateTimeValues
- export_dll_name
name of the exported DLL.
- Type:
str
- export_table_modification_time
export table last modification date and time.
- Type:
dfdatetime.DateTimeValues
- imphash
“Import Hash” of the Portable Executable (PE) file.
- Type:
str
- load_configuration_table_modification_time
load configuration table last modification date and time.
- Type:
dfdatetime.DateTimeValues
- pe_type
type of Portable Executable (PE) file.
- Type:
str
- section_names
names of the sections in the Portable Executable (PE) file.
- Type:
list[str]
- DATA_TYPE = 'pe_coff:file'
- class plaso.parsers.pe.PEParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Portable Executable (PE) files.
- DATA_FORMAT = 'Portable Executable (PE) file'
- NAME = 'pe'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Portable Executable (PE) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.pe.PEResourceEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Portable Executable (PE) resource event data.
- identifier
identifier of the resource.
- Type:
int
- modification_time
last modification date and time.
- Type:
dfdatetime.DateTimeValues
- name
name of the resource.
- Type:
str
- DATA_TYPE = 'pe_coff:resource'
plaso.parsers.plist module
Parser for binary and text Property List (plist) files.
- class plaso.parsers.plist.PlistParser[source]
Bases:
FileObjectParser
Parser for binary and text Property List (plist) files.
- DATA_FORMAT = 'Property list (plist) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
a format specification or None if not available.
- Return type:
- NAME = 'plist'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a plist file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.pls_recall module
Parser for PL/SQL Developer Recall files.
- class plaso.parsers.pls_recall.PlsRecallEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
PL/SQL Recall event data.
- database_name
name of the database.
- Type:
str
- offset
offset of the PL/SQL Recall record relative to the start of the file, from which the event data was extracted.
- Type:
int
- query
PL/SQL query.
- Type:
str
- sequence_number
sequence number.
- Type:
int
- username
username used to query.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'pls_recall:entry'
- class plaso.parsers.pls_recall.PlsRecallParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parse PL/SQL Recall files.
This parser is based on the Delphi definition of the data type:
- TRecallRecord = packed record
Sequence: Integer; TimeStamp: TDateTime; Username: array[0..30] of Char; Database: array[0..80] of Char; Text: array[0..4000] of Char;
end;
Delphi TDateTime is a little-endian 64-bit floating-point value without time zone information.
- DATA_FORMAT = 'PL SQL cache file (PL-SQL developer recall file) format'
- NAME = 'pls_recall'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a PLSRecall.dat file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.plugins module
This file contains basic interface for plugins within Plaso.
This library serves a basis for all plugins in Plaso, whether that are Windows Registry plugins, SQLite plugins or any other parsing plugins.
This is provided as a separate file to make it easier to inherit in other projects that may want to use the Plaso plugin system.
- class plaso.parsers.plugins.BasePlugin[source]
Bases:
object
A plugin is a lightweight parser that makes use of a common data structure.
When a data structure is common among several artifacts or files a plugin infrastructure can be written to make writing parsers simpler. The goal of a parser plugin is to have only a single parser that understands the data structure that can call plugins that have specialized knowledge of certain structures.
An example of this is a SQLite database. A plugin can be written that has knowledge of certain database, such as Chrome history, or Skype history, etc. This can be done without needing to write a fully-fledged parser that needs to re-implement the data structure knowledge. A single parser can be created that calls the plugins to see if it knows that particular database.
Another example is Windows Registry, there a single parser that can parse the Registry can be made and the job of a single plugin is to parse a particular Registry key. The parser can then read a Registry key and compare it to a list of available plugins to see if it can be parsed.
- DATA_FORMAT = ''
- NAME = 'base_plugin'
- Process(parser_mediator, **kwargs)[source]
Extracts events using a parser plugin.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
kwargs (dict[str, object]) – Depending on the plugin they may require different sets of arguments to be able to evaluate whether or not this is the correct plugin.
- Raises:
ValueError – when there are unused keyword arguments.
- UpdateChainAndProcess(parser_mediator, **kwargs)[source]
Extracts events using a parser plugin and synchronizes the parser chain.
This method updates the parser chain object held by the mediator, transfers control to the plugin-specific Process() method, and updates the chain again once the processing is complete.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
- class plaso.parsers.plugins.BasePluginCache[source]
Bases:
object
A generic cache for parser plugins.
- GetResults(attribute, default_value=None)[source]
Retrieves a cached attribute.
- Parameters:
attribute (str) – name of the cached attribute.
default_value (Optional[object]) – default value.
- Returns:
- value of the cached attribute or default value if the cache
does not contain the attribute.
- Return type:
object
plaso.parsers.presets module
The parser and parser plugin presets.
- class plaso.parsers.presets.ParserPreset(name, parsers)[source]
Bases:
object
Parser and parser plugin preset.
- deprecated
True if the preset is deprecated.
- Type:
bool
- name
name of the preset.
- Type:
str
- operating_systems
operating system artifact attribute containers, that specify to which operating systems the preset applies.
- Type:
list[OperatingSystemArtifact]
- parsers
names of parser and parser plugins.
- Type:
list[str]
- class plaso.parsers.presets.ParserPresetsManager[source]
Bases:
object
The parsers and plugin presets manager.
- GetNames()[source]
Retrieves the preset names.
- Returns:
preset names in alphabetical order.
- Return type:
list[str]
- GetParsersByPreset(preset_name)[source]
Retrieves the parser and plugin names of a specific preset.
- Parameters:
preset_name (str) – name of the preset.
- Returns:
parser and plugin names in alphabetical order.
- Return type:
list[str]
- Raises:
KeyError – if the preset does not exist.
- GetPresetByName(name)[source]
Retrieves a specific preset definition by name.
- Parameters:
name (str) – name of the preset.
- Returns:
a parser preset or None if not available.
- Return type:
- GetPresetsByOperatingSystem(operating_system)[source]
Retrieves preset definitions for a specific operating system.
- Parameters:
operating_system (OperatingSystemArtifact) – an operating system artifact attribute container.
- Returns:
- preset definition that correspond with the
operating system.
- Return type:
list[PresetDefinition]
- GetPresetsInformation()[source]
Retrieves the presets information.
- Returns:
containing:
str: preset name. str: comma separated parser and plugin names that are defined by
the preset.
- Return type:
list[tuple]
- ReadFromFile(path)[source]
Reads parser and parser plugin presets from a file.
- Parameters:
path (str) – path of file that contains the the parser and parser plugin presets configuration.
- Raises:
MalformedPresetError – if one or more plugin preset definitions are malformed.
plaso.parsers.recycler module
Parser for Windows Recycle files, INFO2 and $I/$R pairs.
- class plaso.parsers.recycler.WinRecycleBinEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Recycle Bin event data.
- deletion_time
file entry deletion date and time.
- Type:
dfdatetime.DateTimeValues
- drive_number
drive number.
- Type:
int
- file_size
file size.
- Type:
int
- offset
offset of the Recycle Bin record relative to the start of the file, from which the event data was extracted.
- Type:
int
- original_filename
filename.
- Type:
str
- record_index
index of the record, from which the event data was extracted.
- Type:
int
- short_filename
short filename.
- Type:
str
- DATA_TYPE = 'windows:metadata:deleted_item'
- class plaso.parsers.recycler.WinRecycleBinParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses the Windows $Recycle.Bin $I files.
- DATA_FORMAT = 'Windows $Recycle.Bin $I file'
- NAME = 'recycle_bin'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Recycle.Bin metadata ($I) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.recycler.WinRecyclerInfo2Parser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses the Windows Recycler INFO2 file.
- DATA_FORMAT = 'Windows Recycler INFO2 file'
- NAME = 'recycle_bin_info2'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Recycler INFO2 file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.spotlight_storedb module
Parser for Apple Spotlight store database files.
- class plaso.parsers.spotlight_storedb.BaseSpotlightFile[source]
Bases:
DtFabricHelper
Shared functionality for Apple Spotlight files.
- Close()[source]
Closes an Apple Spotlight file.
- Raises:
IOError – if the file is not opened.
OSError – if the file is not opened.
- Open(file_entry)[source]
Opens an Apple Spotlight file.
- Parameters:
file_entry (dfvfs.FileEntry) – a file entry.
- Raises:
IOError – if the file is already opened.
OSError – if the file is already opened.
- class plaso.parsers.spotlight_storedb.SpotlightStoreDatabaseParser[source]
Bases:
FileEntryParser
,DtFabricHelper
Parser for Apple Spotlight store database (store.db) files.
- DATA_FORMAT = 'Apple Spotlight store database (store.db) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'spotlight_storedb'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses an Apple Spotlight store database file entry.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – a file entry to parse.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.spotlight_storedb.SpotlightStoreIndexValue[source]
Bases:
object
Index value.
- table_index
table index.
- Type:
int
- values_list
values list.
- Type:
list[str]
- class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataAttribute[source]
Bases:
object
Metadata attribute.
- key
key or name of the metadata attribute.
- Type:
str
- property_type
metadata attribute property type.
- Type:
int
- value
metadata attribute value.
- Type:
object
- value_type
metadata attribute value type.
- Type:
int
- class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataItem[source]
Bases:
object
Metadata item.
- attributes
metadata attributes.
- Type:
dict[str, SpotlightStoreMetadataAttribute]
- data_size
size of the record data.
- Type:
int
- flags
record flags.
- Type:
int
- identifier
file (system) entry identifier.
- Type:
int
- item_identifier
item identifier.
- Type:
int
- last_update_time
last update time.
- Type:
int
- parent_identifier
parent file (system) entry identifier.
- Type:
int
- class plaso.parsers.spotlight_storedb.SpotlightStoreMetadataItemEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple Spotlight store database metadata item event data.
- added_time
date and time the item was added (kMDItemDateAdded).
- Type:
dfdatetime.DateTimeValues
- attribute_change_time
date and time an attribute was last changed (kMDItemAttributeChangeDate).
- Type:
dfdatetime.DateTimeValues
- content_creation_time
date and time the content was created (kMDItemContentCreationDate).
- Type:
dfdatetime.DateTimeValues
- content_modification_time
date and time the content was last modified (kMDItemContentModificationDate).
- Type:
dfdatetime.DateTimeValues
- content_type
content type of the corresponding file (system) entry (kMDItemContentType).
- Type:
str
- creation_time
date and time the item was created (_kMDItemCreationDate).
- Type:
dfdatetime.DateTimeValues
- downloaded_time
date and time the item was downloaded (kMDItemDownloadedDate).
- Type:
dfdatetime.DateTimeValues
- file_name
name of the corresponding file (system) entry (_kMDItemFileName).
- Type:
str
- file_system_identifier
file system identifier, for example the catalog node identifier (CNID) on HFS.
- Type:
int
- kind
item kind (kMDItemKind).
- Type:
str
- modification_time
date and time the item was last modified (_kMDItemContentChangeDate).
- Type:
dfdatetime.DateTimeValues
- parent_file_system_identifier
file system identifier of the parent.
- Type:
int
- purchase_time
date and time the item was purchased in the AppStore (kMDItemAppStorePurchaseDate).
- Type:
dfdatetime.DateTimeValues
- snapshot_times
dates and times of the creation of backup snaphots (_kTimeMachineOldestSnapshot and _kTimeMachineNewestSnapshot).
- Type:
list[dfdatetime.DateTimeValues]
- update_time
date and time the item was last updated.
- Type:
dfdatetime.DateTimeValues
- used_times
dates and times when the item was used (kMDItemUsedDates and kMDItemLastUsedDate).
- Type:
list[dfdatetime.DateTimeValues]
- DATA_TYPE = 'spotlight:metadata_item'
- class plaso.parsers.spotlight_storedb.SpotlightStreamsMapDataFile(data_size, ranges)[source]
Bases:
BaseSpotlightFile
Apple Spotlight database streams map data file (dbStr-#.map.data).
- stream_values
stream values.
- Type:
list[bytes]
- ReadFileObject(file_object)[source]
Reads a database streams map data file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
- class plaso.parsers.spotlight_storedb.SpotlightStreamsMapHeaderFile[source]
Bases:
BaseSpotlightFile
Apple Spotlight database streams map header file (dbStr-#.map.header).
- data_size
data size.
- Type:
int
- number_of_buckets
number of entries in the database streams map buckets file (dbStr-#.map.buckets).
- Type:
int
- number_of_offsets
number of entries in the database streams map offsets file (dbStr-#.map.offsets).
- Type:
int
- ReadFileObject(file_object)[source]
Reads a database streams map header file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
- class plaso.parsers.spotlight_storedb.SpotlightStreamsMapOffsetsFile(data_size, number_of_entries)[source]
Bases:
BaseSpotlightFile
Apple Spotlight database streams map offsets file (dbStr-#.map.offsets).
- ranges
offset and size pairs of the stream value data ranges.
- Type:
list[tuple[int, int]]
- ReadFileObject(file_object)[source]
Reads a database streams map offsets file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
plaso.parsers.sqlite module
SQLite parser.
- class plaso.parsers.sqlite.SQLiteCache[source]
Bases:
BasePluginCache
Cache for storing results of SQL queries.
- CacheQueryResults(sql_results, attribute_name, key_name, column_names)[source]
Build a dictionary object based on a SQL command.
This function will take a SQL command, execute it and for each resulting row it will store a key in a dictionary.
An example:
sql_results = A SQL result object after executing the SQL command: 'SELECT foo, bla, bar FROM my_table' attribute_name = 'all_the_things' key_name = 'foo' column_names = ['bla', 'bar']
Results from running this against the database: ‘first’, ‘stuff’, ‘things’ ‘second’, ‘another stuff’, ‘another thing’
This will result in a dictionary object being created in the cache, called ‘all_the_things’ and it will contain the following value:
all_the_things = { 'first': ['stuff', 'things'], 'second': ['another_stuff', 'another_thing'], 'third': ['single_thing']}
- Parameters:
sql_results (sqlite3.Cursor) – result after executing a SQL command on a database.
attribute_name (str) – attribute name in the cache to store results to. This will be the name of the dictionary attribute.
key_name (str) – name of the result field that should be used as a key in the resulting dictionary that is created.
column_names (list[str]) – of column names that are stored as values to the dictionary. If this list has only one value in it the value will be stored directly, otherwise the value will be a list containing the extracted results based on the names provided in this list.
- GetRowCache(query)[source]
Retrieves the row cache for a specific query.
The row cache is a set that contains hashes of values in a row. The row cache is used to find duplicate row when a database and a database with a WAL file is parsed.
- Parameters:
query (str) – query.
- Returns:
hashes of the rows that have been parsed.
- Return type:
set
- class plaso.parsers.sqlite.SQLiteDatabase(filename, temporary_directory=None)[source]
Bases:
object
SQLite database.
- schema
schema as an SQL query per table name, for example {‘Users’: ‘CREATE TABLE Users (“id” INTEGER PRIMARY KEY, …)’}.
- Type:
dict[str, str]
- Open(file_object, wal_file_object=None)[source]
Opens a SQLite database file.
Since pysqlite cannot read directly from a file-like object a temporary copy of the file is made. After creating a copy the database file this function sets up a connection with the database and determines the names of the tables.
- Parameters:
file_object (dfvfs.FileIO) – file-like object.
wal_file_object (Optional[dfvfs.FileIO]) – file-like object for the Write-Ahead Log (WAL) file.
- Raises:
IOError – if the file-like object cannot be read.
OSError – if the file-like object cannot be read.
sqlite3.DatabaseError – if the database cannot be parsed.
ValueError – if the file-like object is missing.
- Query(query)[source]
Queries the database.
- Parameters:
query (str) – SQL query.
- Returns:
results.
- Return type:
sqlite3.Cursor
- Raises:
sqlite3.DatabaseError – if querying the database fails.
- SCHEMA_QUERY = 'SELECT tbl_name, sql FROM sqlite_master WHERE type = "table" AND tbl_name != "xp_proc" AND tbl_name != "sqlite_sequence"'
- __init__(filename, temporary_directory=None)[source]
Initializes a SQLite database.
- Parameters:
filename (str) – name of the file entry.
temporary_directory (Optional[str]) – path of the directory for temporary files.
- property tables
names of all the tables.
- Type:
List[str]
- class plaso.parsers.sqlite.SQLiteParser[source]
Bases:
FileEntryParser
Parses SQLite database files.
- DATA_FORMAT = 'SQLite database file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
a format specification or None if not available.
- Return type:
- NAME = 'sqlite'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses a SQLite database file entry.
- Parameters:
parser_mediator (ParserMediator) – parser mediator.
file_entry (dfvfs.FileEntry) – file entry to be parsed.
plaso.parsers.symantec module
Symantec AV Corporate Edition and Endpoint Protection log file parser.
- class plaso.parsers.symantec.SymantecEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Symantec event data.
- access
access.
- Type:
str
- action0
action0.
- Type:
str
- action1
action1.
- Type:
str
- action1_status
action1 status.
- Type:
str
- action2
action2.
- Type:
str
- action2_status
action2 status.
- Type:
str
- address
address.
- Type:
str
- backup_id
backup identifier.
- Type:
str
- cat
category.
- Type:
str
- cleaninfo
clean information.
- Type:
str
- clientgroup
client group.
- Type:
str
- compressed
compressed.
- Type:
str
- computer
computer.
- Type:
str
- definfo
definfo.
- Type:
str
- defseqnumber
def sequence number.
- Type:
str
- deleteinfo
delete information.
- Type:
str
- depth
depth.
- Type:
str
- description
description.
- Type:
str
- domain_guid
domain identifier (GUID).
- Type:
str
- domainname
domain name.
- Type:
str
- err_code
error code.
- Type:
str
- event_data
event data.
- Type:
str
- event
event.
- Type:
str
- extra
extra.
- Type:
str
- file
file.
- Type:
str
- flags
flags.
- Type:
str
- groupid
group identifier.
- Type:
str
- guid
guid.
- Type:
str
- last_written_time
entry last written date and time.
- Type:
dfdatetime.DateTimeValues
- license_expiration_dt
license expiration date.
- Type:
str
- license_feature_name
license feature name.
- Type:
str
- license_feature_ver
license feature ver.
- Type:
str
- license_fulfillment_id
license fulfillment identifier.
- Type:
str
- license_lifecycle
license lifecycle.
- Type:
str
- license_seats_delta
license seats delta.
- Type:
str
- license_seats
license seats.
- Type:
str
- license_seats_total
license seats total.
- Type:
str
- license_serial_num
license serial number.
- Type:
str
- license_start_dt
license start date.
- Type:
str
- logger
logger.
- Type:
str
- login_domain
login domain.
- Type:
str
- log_session_guid
log session identifier (GUID).
- Type:
str
- macaddr
MAC address.
- Type:
str
- new_ext
new ext.
- Type:
str
- ntdomain
ntdomain.
- Type:
str
- offset
offset.
- Type:
str
- parent
parent.
- Type:
str
- quarfwd_status
quarfwd status.
- Type:
str
- remote_machine_ip
remote machine IP address.
- Type:
str
- remote_machine
remote machine.
- Type:
str
- scanid
scan identifier.
- Type:
str
- snd_status
snd status.
- Type:
str
- status
status.
- Type:
str
- still_infected
still infected.
- Type:
str
- time
time.
- Type:
str
- user
user.
- Type:
str
- vbin_id
vbin identifier.
- Type:
str
- vbin_session_id
vbin session identifier.
- Type:
str
- version
version.
- Type:
str
- virus_id
virus identifier.
- Type:
str
- virus
virus.
- Type:
str
- virustype
virustype.
- Type:
str
- DATA_TYPE = 'av:symantec:scanlog'
- class plaso.parsers.symantec.SymantecParser[source]
Bases:
DSVParser
Parses Symantec AV Corporate Edition and Endpoint Protection log files.
- COLUMNS = ['time', 'event', 'cat', 'logger', 'computer', 'user', 'virus', 'file', 'action1', 'action2', 'action0', 'virustype', 'flags', 'description', 'scanid', 'new_ext', 'groupid', 'event_data', 'vbin_id', 'virus_id', 'quarfwd_status', 'access', 'snd_status', 'compressed', 'depth', 'still_infected', 'definfo', 'defseqnumber', 'cleaninfo', 'deleteinfo', 'backup_id', 'parent', 'guid', 'clientgroup', 'address', 'domainname', 'ntdomain', 'macaddr', 'version:', 'remote_machine', 'remote_machine_ip', 'action1_status', 'action2_status', 'license_feature_name', 'license_feature_ver', 'license_serial_num', 'license_fulfillment_id', 'license_start_dt', 'license_expiration_dt', 'license_lifecycle', 'license_seats_total', 'license_seats', 'err_code', 'license_seats_delta', 'status', 'domain_guid', 'log_session_guid', 'vbin_session_id', 'login_domain', 'extra']
- DATA_FORMAT = 'Symantec AV Corporate Edition and Endpoint Protection log file'
- NAME = 'symantec_scanlog'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – line number of the row.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
plaso.parsers.systemd_journal module
Parser for Systemd journal files.
- class plaso.parsers.systemd_journal.SystemdJournalEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Systemd journal event data.
- body
message body.
- Type:
str
- hostname
hostname.
- Type:
str
- pid
process identifier (PID).
- Type:
int
- reporter
reporter.
- Type:
str
- written_time
date and time the log entry was written.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'systemd:journal'
- class plaso.parsers.systemd_journal.SystemdJournalParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses Systemd Journal files.
- DATA_FORMAT = 'Systemd journal file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'systemd_journal'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Systemd journal file-like object.
- Parameters:
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the header cannot be parsed.
plaso.parsers.text_parser module
Text log parser.
- class plaso.parsers.text_parser.EncodedTextReader(file_object, encoding='utf-8', encoding_errors='strict')[source]
Bases:
object
Encoded text reader.
- line_number
current line number.
- Type:
int
- lines
lines of text.
- Type:
str
- lines_size
size of the lines of text.
- Type:
int
- BUFFER_SIZE = 65536
- SkipAhead(number_of_characters)[source]
Skips ahead a number of characters.
- Parameters:
number_of_characters (int) – number of characters.
- class plaso.parsers.text_parser.TextLogParser[source]
Bases:
FileObjectParser
Text-based log file parser.
- DATA_FORMAT = 'text-based log file'
- EnablePlugins(plugin_includes)[source]
Enables parser plugins.
- Parameters:
plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.
- NAME = 'text'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a text log file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.trendmicroav module
Parser for Trend Micro Antivirus logs.
Trend Micro uses two log files to track the scans (both manual/scheduled and real-time) and the web reputation (network scan/filtering).
Currently only the first log is supported.
- class plaso.parsers.trendmicroav.OfficeScanVirusDetectionParser[source]
Bases:
TrendMicroBaseParser
Parses the Trend Micro Office Scan Virus Detection Log.
- COLUMNS = ['date', 'time', 'threat', 'action', 'scan_type', 'unused1', 'path', 'filename', 'unused2', 'timestamp', 'unused3', 'unused4']
- DATA_FORMAT = 'Trend Micro Office Scan Virus Detection log file'
- NAME = 'trendmicro_vd'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
- class plaso.parsers.trendmicroav.OfficeScanWebReputationParser[source]
Bases:
TrendMicroBaseParser
Parses the Trend Micro Office Scan Web Reputation detection log.
- COLUMNS = ('date', 'time', 'block_mode', 'url', 'group_code', 'group_name', 'credibility_rating', 'policy_identifier', 'application_name', 'credibility_score', 'ip', 'threshold', 'timestamp', 'unused')
- DATA_FORMAT = 'Trend Micro Office Web Reputation log file'
- NAME = 'trendmicro_url'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
- class plaso.parsers.trendmicroav.TrendMicroAVEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Trend Micro AV Log event data.
- action
action.
- Type:
str
- filename
filename.
- Type:
str
- offset
offset of the line relative to the start of the file, from which the event data was extracted.
- Type:
int
- path
path.
- Type:
str
- scan_type
scan_type.
- Type:
str
- threat
threat.
- Type:
str
- written_time
date and time the log entry was written.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'av:trendmicro:scan'
- class plaso.parsers.trendmicroav.TrendMicroBaseParser[source]
Bases:
DSVParser
Common code for parsing Trend Micro log files.
The file format is reminiscent of CSV, but is not quite the same; the delimiter is a three-character sequence and there is no provision for quoting or escaping.
- COLUMNS = ()
- DELIMITER = '<;>'
- class plaso.parsers.trendmicroav.TrendMicroUrlEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Trend Micro Web Reputation Log event data.
- application_name
application name.
- Type:
str
- block_mode
operation mode.
- Type:
str
- credibility_rating
credibility rating.
- Type:
int
- credibility_score
credibility score.
- Type:
int
- group_code
group code.
- Type:
str
- group_name
group name.
- Type:
str
- ip
IP address.
- Type:
str
- offset
offset of the line relative to the start of the file, from which the event data was extracted.
- Type:
int
- policy_identifier
policy identifier.
- Type:
int
- threshold
threshold value.
- Type:
int
- url
accessed URL.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'av:trendmicro:webrep'
plaso.parsers.unified_logging module
The Apple Unified Logging (AUL) file parser.
- class plaso.parsers.unified_logging.BacktraceFrame[source]
Bases:
object
Backtrace frame.
- image_identifier
image identifier, contains an UUID.
- Type:
str
- image_offset
image offset.
- Type:
int
- class plaso.parsers.unified_logging.BaseFormatStringDecoder[source]
Bases:
object
Format string decoder interface.
- abstract FormatValue(value, format_string_operator=None)[source]
Formats a value.
- Parameters:
value (bytes) – value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted value.
- Return type:
str
- class plaso.parsers.unified_logging.BaseLocationStructureFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
,DtFabricHelper
Shared functionality for location structure format string decoders.
- class plaso.parsers.unified_logging.BaseMDNSDNSStructureFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
,DtFabricHelper
Shared functionality for mDNS DNS structure format string decoders.
- class plaso.parsers.unified_logging.BaseUnifiedLoggingFile[source]
Bases:
DtFabricHelper
Shared functionality for Apple Unified Logging (AUL) files.
- Close()[source]
Closes an Apple Unified Logging (AUL) file.
- Raises:
IOError – if the file is not opened.
OSError – if the file is not opened.
- Open(file_entry)[source]
Opens an Apple Unified Logging (AUL) file.
- Parameters:
file_entry (dfvfs.FileEntry) – a file entry.
- Raises:
IOError – if the file is already opened.
OSError – if the file is already opened.
- class plaso.parsers.unified_logging.BooleanFormatStringDecoder(false_value='false', true_value='true')[source]
Bases:
BaseFormatStringDecoder
Boolean value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a boolean value.
- Parameters:
value (bytes) – boolean value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted boolean value.
- Return type:
str
- class plaso.parsers.unified_logging.DSCFile[source]
Bases:
BaseUnifiedLoggingFile
Shared-Cache Strings (dsc) file.
- GetImageValues(string_reference, is_dynamic)[source]
Retrieves image values.
- Parameters:
string_reference (int) – reference of the string.
is_dynamic (bool) – dynamic flag.
- Returns:
image value or None if not available.
- Return type:
- Raises:
ParseError – if the image values cannot be read.
- ReadFileObject(file_object)[source]
Reads a shared-cache strings (dsc) file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
- class plaso.parsers.unified_logging.DSCRange[source]
Bases:
object
Shared-Cache Strings (dsc) range.
- data_offset
offset of the string data.
- Type:
int
- image_identifier
the image identifier.
- Type:
uuid.UUID
- image_path
the image path.
- Type:
str
- range_offset
the offset of the range.
- Type:
int
- range_sizes
the size of the range.
- Type:
int
- text_offset
the offset of the text.
- Type:
int
- text_size
the size of the text.
- Type:
int
- uuid_index
index of the dsc UUID.
- Type:
int
- class plaso.parsers.unified_logging.DSCUUID[source]
Bases:
object
Shared-Cache Strings (dsc) UUID.
- image_identifier
the image identifier.
- Type:
uuid.UUID
- image_path
the image path.
- Type:
str
- text_offset
the offset of the text.
- Type:
int
- text_size
the size of the text.
- Type:
int
- class plaso.parsers.unified_logging.DateTimeInSecondsFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Date and time value in seconds format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a date and time value in seconds.
- Parameters:
value (bytes) – timestamp that contains the number of seconds since 1970-01-01 00:00:00.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted date and time value in seconds.
- Return type:
str
- class plaso.parsers.unified_logging.ErrorCodeFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Error code format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an error code value.
- Parameters:
value (bytes) – error code value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted error code value.
- Return type:
str
- class plaso.parsers.unified_logging.ExtendedErrorCodeFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Extended error code format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an error code value.
- Parameters:
value (bytes) – error code value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted error code value.
- Return type:
str
- class plaso.parsers.unified_logging.FileModeFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
File mode format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a file mode value.
- Parameters:
value (bytes) – file mode value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted file mode value.
- Return type:
str
- class plaso.parsers.unified_logging.FloatingPointFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Floating-point value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a floating-point value.
- Parameters:
value (bytes) – floating-point value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted floating-point value.
- Return type:
str
- class plaso.parsers.unified_logging.FormatStringOperator(flags=None, precision=None, specifier=None, width=None)[source]
Bases:
object
Format string operator.
- flags
flags.
- Type:
str
- precision
precision.
- Type:
str
- specifier
conversion specifier.
- Type:
str
- width
width.
- Type:
str
- class plaso.parsers.unified_logging.IPv4FormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
IPv4 value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an IPv4 value.
- Parameters:
value (bytes) – IPv4 value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted IPv4 value.
- Return type:
str
- class plaso.parsers.unified_logging.IPv6FormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
IPv6 value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an IPv6 value.
- Parameters:
value (bytes) – IPv6 value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted IPv6 value.
- Return type:
str
- class plaso.parsers.unified_logging.ImageValues(identifier=None, path=None, string=None, text_offset=None)[source]
Bases:
object
Image values.
- identifier
the identifier.
- Type:
uuid.UUID
- path
the path.
- Type:
str
- string
the string.
- Type:
str
- text_offset
the offset of the text.
- Type:
int
- class plaso.parsers.unified_logging.LocationClientAuthorizationStatusFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Location client authorization status format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a client authorization status value.
- Parameters:
value (bytes) – client authorization status value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted client authorization status value.
- Return type:
str
- class plaso.parsers.unified_logging.LocationClientManagerStateFormatStringDecoder[source]
Bases:
BaseLocationStructureFormatStringDecoder
Location client manager state format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a location client manager state value.
- Parameters:
value (bytes) – location client manager state value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted location client manager state value.
- Return type:
str
- class plaso.parsers.unified_logging.LocationEscapeOnlyFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Location escape only format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a location value.
- Parameters:
value (bytes) – location value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted location value.
- Return type:
str
- class plaso.parsers.unified_logging.LocationLocationManagerStateFormatStringDecoder[source]
Bases:
BaseLocationStructureFormatStringDecoder
Location location manager state format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a location location manager state value.
- Parameters:
value (bytes) – location location manager state value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted location location manager state value.
- Return type:
str
- class plaso.parsers.unified_logging.LocationSQLiteResultFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Location SQLite result format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a SQLite result value.
- Parameters:
value (bytes) – SQLite result.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted SQLite result value.
- Return type:
str
- class plaso.parsers.unified_logging.LogEntry[source]
Bases:
object
Log entry.
- activity_identifier
activity identifier.
- Type:
int
- backtrace_frames
backtrace frames.
- Type:
list[BacktraceFrame]
- boot_identifier
boot identifier.
- Type:
uuid.UUID
- category
(sub system) category.
- Type:
str
- creator_activity_identifier
creator activity identifier.
- Type:
int
- event_message
event message.
- Type:
str
- event_type
event type.
- Type:
str
- format_string
format string.
- Type:
str
- loss_count
number of message lost.
- Type:
int
- loss_end_mach_timestamp
Mach timestamp of the end of the message loss.
- Type:
int
- loss_end_timestamp
timestamp of the end of the message loss, in number of nanoseconds since January 1, 1970 00:00:00.000000000
- Type:
int
- loss_start_mach_timestamp
Mach timestamp of the start of the message loss.
- Type:
int
- loss_start_timestamp
timestamp of the start of the message loss, in number of nanoseconds since January 1, 1970 00:00:00.000000000
- Type:
int
- mach_timestamp
Mach timestamp.
- Type:
int
- message_type
message type.
- Type:
str
- parent_activity_identifier
parent activity identifier.
- Type:
int
- process_identifier
process identifier (PID).
- Type:
int
- process_image_identifier
process image identifier.
- Type:
uuid.UUID
- process_image_path
path of the process image.
- Type:
str
- sender_image_identifier
(sender) image identifier.
- Type:
uuid.UUID
- sender_image_path
path of the (sender) image.
- Type:
str
- sender_program_counter
(sender) program counter.
- Type:
int
- signpost_identifier
signpost identifier.
- Type:
int
- signpost_name
signpost name.
- Type:
str
- signpost_scope
signpost scope.
- Type:
str
- signpost_type
signpost type.
- Type:
str
- sub_system
sub system.
- Type:
str
- thread_identifier
thread identifier.
- Type:
int
- timestamp
number of nanoseconds since January 1, 1970 00:00:00.000000000.
- Type:
int
- time_zone_name
name of the time zone.
- Type:
str
- trace_identifier
trace identifier.
- Type:
int
- ttl
Time to live (TTL) value.
- Type:
int
- class plaso.parsers.unified_logging.MDNSDNSCountersFormatStringDecoder[source]
Bases:
BaseMDNSDNSStructureFormatStringDecoder
mDNS DNS counters format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a mDNS DNS counters value.
- Parameters:
value (bytes) – mDNS DNS counters value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted mDNS DNS counters value.
- Return type:
str
- class plaso.parsers.unified_logging.MDNSDNSHeaderFormatStringDecoder[source]
Bases:
BaseMDNSDNSStructureFormatStringDecoder
mDNS DNS header format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a mDNS DNS header value.
- Parameters:
value (bytes) – mDNS DNS header value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted mDNS DNS header value.
- Return type:
str
- class plaso.parsers.unified_logging.MDNSDNSIdentifierAndFlagsFormatStringDecoder[source]
Bases:
BaseMDNSDNSStructureFormatStringDecoder
mDNS DNS identifier and flags string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a mDNS DNS identifier and flags value.
- Parameters:
value (bytes) – mDNS DNS identifier and flags value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted mDNS DNS identifier and flags value.
- Return type:
str
- class plaso.parsers.unified_logging.MDNSProtocolFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
mDNS protocol format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a mDNS protocol value.
- Parameters:
value (bytes) – mDNS protocol value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted mDNS protocol value.
- Return type:
str
- class plaso.parsers.unified_logging.MDNSReasonFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
mDNS reason format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a mDNS reason value.
- Parameters:
value (bytes) – mDNS reason value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted mDNS reason value.
- Return type:
str
- class plaso.parsers.unified_logging.MDNSResourceRecordTypeFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
mDNS resource record type format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a mDNS resource record type value.
- Parameters:
value (bytes) – mDNS resource record type value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted mDNS resource record type value.
- Return type:
str
- class plaso.parsers.unified_logging.MaskHashFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Mask hash format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a value as a mask hash.
- Parameters:
value (bytes) – value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted value as a mask hash.
- Return type:
str
- class plaso.parsers.unified_logging.OpenDirectoryErrorFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Open Directory error format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an Open Directory error value.
- Parameters:
value (bytes) – Open Directory error value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Open Directory error value.
- Return type:
str
- class plaso.parsers.unified_logging.OpenDirectoryMembershipDetailsFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
,DtFabricHelper
Open Directory membership details format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an Open Directory membership details value.
- Parameters:
value (bytes) – Open Directory membership details value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Open Directory membership details value.
- Return type:
str
- class plaso.parsers.unified_logging.OpenDirectoryMembershipTypeFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Open Directory membership type format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an Open Directory membership type value.
- Parameters:
value (bytes) – Open Directory membership type value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Open Directory membership type value.
- Return type:
str
- class plaso.parsers.unified_logging.SignedIntegerFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Signed integer value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a signed integer value.
- Parameters:
value (bytes) – signed integer value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted signed integer value.
- Return type:
str
- class plaso.parsers.unified_logging.SignpostDescriptionAttributeFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Signpost description attribute value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a Signpost description attribute value.
- Parameters:
value (bytes) – Signpost description attribute value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Signpost description attribute value.
- Return type:
str
- class plaso.parsers.unified_logging.SignpostDescriptionTimeFormatStringDecoder(time='begin')[source]
Bases:
BaseFormatStringDecoder
Signpost description time value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a Signpost description time value.
- Parameters:
value (bytes) – Signpost description time value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Signpost description time value.
- Return type:
str
- class plaso.parsers.unified_logging.SignpostTelemetryNumberFormatStringDecoder(number=1)[source]
Bases:
BaseFormatStringDecoder
Signpost telemetry number value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a Signpost telemetry number value.
- Parameters:
value (bytes) – Signpost telemetry number value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Signpost telemetry number value.
- Return type:
str
- class plaso.parsers.unified_logging.SignpostTelemetryStringFormatStringDecoder(number=1)[source]
Bases:
BaseFormatStringDecoder
Signpost telemetry string value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a Signpost telemetry string value.
- Parameters:
value (bytes) – Signpost telemetry string value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Signpost telemetry string value.
- Return type:
str
- class plaso.parsers.unified_logging.SocketAddressFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Socket address value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a socket address value.
- Parameters:
value (bytes) – socket address value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted socket address value.
- Return type:
str
- class plaso.parsers.unified_logging.StringFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
String value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a string value.
- Parameters:
value (bytes) – string value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted string value.
- Return type:
str
- class plaso.parsers.unified_logging.StringFormatter[source]
Bases:
object
String formatter.
- FormatString(values)[source]
Formats the string.
- Parameters:
values (list[str]) – values.
- Returns:
formatted string.
- Return type:
str
- GetDecoderNamesByIndex(value_index)[source]
Retrieves the decoder names of a specific value.
- Parameters:
value_index (int) – value index.
- Returns:
decoder names.
- Return type:
list[str]
- GetFormatStringOperator(value_index)[source]
Retrieves the format string operator of a specific value.
- Parameters:
value_index (int) – value index.
- Returns:
format string operator or None if not available.
- Return type:
- class plaso.parsers.unified_logging.TimesyncDatabaseFile[source]
Bases:
BaseUnifiedLoggingFile
Timesync database file.
- ReadFileObject(file_object)[source]
Reads a timesync file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
- ReadRecords()[source]
Reads a timesync records.
- Yields:
object – boot or sync record.
- Raises:
ParseError – if the file cannot be read.
- class plaso.parsers.unified_logging.TraceV3File(file_system=None)[source]
Bases:
BaseUnifiedLoggingFile
Apple Unified Logging and Activity Tracing (tracev3) file.
- ACTIVITY_IDENTIFIER_BITMASK = 9223372036854775807
- Close()[source]
Closes a tracev3 file.
- Raises:
IOError – if the file is not opened.
OSError – if the file is not opened.
- ReadFileObject(file_object)[source]
Reads a tracev3 file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
- ReadLogEntries()[source]
Reads log traces.
- Yields:
LogEntry – a log entry.
- Raises:
ParseError – if the file cannot be read.
- class plaso.parsers.unified_logging.UUIDFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
UUID value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an UUID value.
- Parameters:
value (bytes) – UUID value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted UUID value.
- Return type:
str
- class plaso.parsers.unified_logging.UUIDTextFile[source]
Bases:
BaseUnifiedLoggingFile
Apple Unified Logging and Activity Tracing (uuidtext) file.
- GetImagePath()[source]
Retrieves the image path.
- Returns:
image path or None if not available.
- Return type:
str
- GetString(string_reference)[source]
Retrieves a string.
- Parameters:
string_reference (int) – reference of the string.
- Returns:
string or None if not available.
- Return type:
str
- Raises:
ParseError – if the string cannot be read.
- ReadFileObject(file_object)[source]
Reads an uuidtext file-like object.
- Parameters:
file_object (file) – file-like object.
- Raises:
ParseError – if the file cannot be read.
- class plaso.parsers.unified_logging.UnifiedLoggingEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Apple Unified Logging (AUL) event data.
- activity_identifier
activity identifier.
- Type:
int
- boot_identifier
boot identifier.
- Type:
str
- category
event category.
- Type:
str
- event_message
event message.
- Type:
str
- event_type
event type.
- Type:
str
- message_type
message type.
- Type:
str
- process_identifier
process identifier (PID).
- Type:
int
- process_image_identifier
process image identifier.
- Type:
str
- process_image_identifier
process image identifier, contains an UUID.
- Type:
str
- recorded_time
date and time the log entry was recorded.
- Type:
dfdatetime.DateTimeValues
- sender_image_identifier
(sender) image identifier, contains an UUID.
- Type:
str
- sender_image_path
path of the (sender) image.
- Type:
str
- signpost_identifier
signpost identifier.
- Type:
int
- signpost_name
signpost name.
- Type:
str
- subsystem
subsystem that produced the logging event.
- Type:
str
- thread_identifier
thread identifier.
- Type:
int
- ttl
log time to live (TTL).
- Type:
int
- DATA_TYPE = 'macos:unified_logging:event'
- class plaso.parsers.unified_logging.UnifiedLoggingParser[source]
Bases:
FileEntryParser
Parses Apple Unified Logging (AUL) tracev3 files.
- DATA_FORMAT = 'Apple Unified Logging (AUL) 64-bit tracev3 file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'unified_logging'
- ParseFileEntry(parser_mediator, file_entry)[source]
Parses an Apple Unified Logging (AUL) tracev3 file entry:
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_entry (dfvfs.FileEntry) – a file entry to parse.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.unified_logging.UnsignedIntegerFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
Unsigned integer value format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats an unsigned integer value.
- Parameters:
value (bytes) – unsigned integer value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted unsigned integer value.
- Return type:
str
- class plaso.parsers.unified_logging.WindowsNTSecurityIdentifierFormatStringDecoder[source]
Bases:
BaseFormatStringDecoder
,DtFabricHelper
Windows NT security identifier (SID) format string decoder.
- FormatValue(value, format_string_operator=None)[source]
Formats a Windows NT security identifier (SID) value.
- Parameters:
value (bytes) – Windows NT security identifier (SID) value.
format_string_operator (Optional[FormatStringOperator]) – format string operator.
- Returns:
formatted Windows NT security identifier (SID) value.
- Return type:
str
plaso.parsers.utmp module
Parser for Linux utmp files.
- class plaso.parsers.utmp.UtmpEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Linux libc6 utmp event data.
- exit_status
exit status.
- Type:
int
- hostname
hostname or IP address.
- Type:
str
- ip_address
IP address from the connection.
- Type:
str
- offset
offset of the utmp record relative to the start of the file, from which the event data was extracted.
- Type:
int
- pid
process identifier (PID).
- Type:
int
- terminal_identifier
inittab identifier.
- Type:
int
- terminal
type of terminal.
- Type:
str
- type
type of login.
- Type:
int
- username
user name.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'linux:utmp:event'
- class plaso.parsers.utmp.UtmpParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Linux libc6 utmp files.
- DATA_FORMAT = 'Linux libc6 utmp file'
- NAME = 'utmp'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an utmp file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.utmpx module
Parser for MacOS utmpx files.
- class plaso.parsers.utmpx.UtmpxMacOSEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
MacOS utmpx event data.
- hostname
hostname or IP address.
- Type:
str
- offset
offset of the utmpx record relative to the start of the file, from which the event data was extracted.
- Type:
int
- pid
process identifier (PID).
- Type:
int
- terminal
name of the terminal.
- Type:
str
- terminal_identifier
inittab identifier.
- Type:
int
- type
type of login.
- Type:
int
- username
user name.
- Type:
str
- written_time
entry written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'macos:utmpx:entry'
- class plaso.parsers.utmpx.UtmpxParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parser for Mac OS X 10.5 utmpx files.
- DATA_FORMAT = 'Mac OS X 10.5 utmpx file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'utmpx'
- ParseFileObject(parser_mediator, file_object)[source]
Parses an UTMPX file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.wincc module
Text parser plugin for WinCC log files.
- class plaso.parsers.wincc.SIMATICLogParser[source]
Bases:
FileObjectParser
Text parser plugin for SIMATIC S7 Log files.
- DATA_FORMAT = 'SIMATIC S7 Log file'
- DELIMITER = ','
- ENCODING = 'ascii'
- END_OF_LINE = '\r\n'
- NAME = 'simatic_s7'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a SIMATIC Log file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.wincc.SIMATICS7EventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
SIMATIC S7 event data.
- body
the message content of the event.
- Type:
str
- creation_time
date and time the log entry was created.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'wincc:simatic_s7:entry'
- class plaso.parsers.wincc.WinCCSysLogEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
WinCC Sys Log event data.
- body
the content of the log’s message.
- Type:
str
- creation_time
date and time the log entry was created.
- Type:
dfdatetime.DateTimeValues
- event_number
a number specifying the type of event.
- Type:
int
- log_hostname
the hostname of the machine logging the event.
- Type:
str
- log_identifier
identifier for this log file.
- Type:
int
- source_device
which device generated the event.
- Type:
str
- DATA_TYPE = 'wincc:sys_log:entry'
- class plaso.parsers.wincc.WinCCSysLogParser[source]
Bases:
FileObjectParser
Text parser plugin for WinCC Sys Log files.
- DATA_FORMAT = 'WinCC Sys Log file'
- DELIMITER = ','
- ENCODING = 'utf-16-le'
- NAME = 'wincc_sys'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a WinCC Sys Log file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
plaso.parsers.windefender_history module
Parser for Windows Defender scan DetectionHistory files.
- class plaso.parsers.windefender_history.WinDefenderHistoryParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parses a Windows Defender scan DetectionHistory file.
- DATA_FORMAT = 'Windows Defender scan DetectionHistory file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'windefender_history'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Defender History file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.windefender_history.WindowsDefenderHistoryEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Defender scan DetectionHistory event data.
- additional_filenames
locations of additional detected files.
- Type:
list[str]
- container_filenames
location of files detected inside a container.
- Type:
list[str]
- filename
name of the file that the threat was detected in.
- Type:
str
- host_and_user
name of the host and user in “DOMAINUSER” format.
- Type:
str
- process
name of the process that caused the detection.
- Type:
str
- recorded_time
date and time the log entry was recorded.
- Type:
dfdatetime.DateTimeValues
- sha256
SHA-256 hash of the file.
- Type:
str
- threat_name
name of the threat that was detected.
- Type:
str
- web_filenames
URI of files detected as downloaded from the web.
- Type:
list[str]
- DATA_TYPE = 'av:defender:detection_history'
plaso.parsers.winevt module
Parser for Windows EventLog (EVT) files.
- class plaso.parsers.winevt.WinEvtParser[source]
Bases:
FileObjectParser
Parses Windows EventLog (EVT) files.
- DATA_FORMAT = 'Windows EventLog (EVT) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'winevt'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows EventLog (EVT) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- class plaso.parsers.winevt.WinEvtRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows EventLog (EVT) record event data.
- creation_time
event record creation date and time.
- Type:
dfdatetime.DateTimeValues
- computer_name
computer name stored in the event record.
- Type:
str
- event_category
event category.
- Type:
int
- event_identifier
event identifier.
- Type:
int
- event_type
event type.
- Type:
int
- facility
event facility.
- Type:
int
- message_identifier
event message identifier.
- Type:
int
- offset
offset of the event record relative to the start of the file, from which the event data was extracted.
- Type:
int
- record_number
event record number.
- Type:
int
- recovered
True if the record was recovered.
- Type:
bool
- severity
event severity.
- Type:
int
- source_name
name of the event source.
- Type:
str
- strings
event strings.
- Type:
list[str]
- user_sid
user security identifier (SID) stored in the event record.
- Type:
str
- written_time
event record written date and time.
- Type:
dfdatetime.DateTimeValues
- DATA_TYPE = 'windows:evt:record'
plaso.parsers.winevtx module
Parser for Windows XML EventLog (EVTX) files.
- class plaso.parsers.winevtx.WinEvtxParser[source]
Bases:
FileObjectParser
Parses Windows XML EventLog (EVTX) files.
- DATA_FORMAT = 'Windows XML EventLog (EVTX) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'winevtx'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows XML EventLog (EVTX) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- class plaso.parsers.winevtx.WinEvtxRecordEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows XML EventLog (EVTX) record event data.
- creation_time
event record creation date and time.
- Type:
dfdatetime.DateTimeValues
- computer_name
computer name stored in the event record.
- Type:
str
- event_identifier
event identifier.
- Type:
int
- event_level
event level.
- Type:
int
- event_version
event version.
- Type:
int
- message_identifier
event message identifier.
- Type:
int
- offset
offset of the EVTX record relative to the start of the file, from which the event data was extracted.
- Type:
int
- provider_identifier
identifier of the EventLog provider.
- Type:
str
- record_number
event record number.
- Type:
int
- recovered
True if the record was recovered.
- Type:
bool
- source_name
name of the event source.
- Type:
str
- strings
event strings.
- Type:
list[str]
- user_sid
user security identifier (SID) stored in the event record.
- Type:
str
- written_time
event record written date and time.
- Type:
dfdatetime.DateTimeValues
- xml_string
XML representation of the event.
- Type:
str
- DATA_TYPE = 'windows:evtx:record'
plaso.parsers.winjob module
Parser for Windows Scheduled Task job files.
- class plaso.parsers.winjob.WinJobEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Scheduled Task event data.
- application
path to job executable.
- Type:
str
- comment
description of the scheduled task.
- Type:
str
- last_run_time
executable (binary) last run date and time.
- Type:
dfdatetime.DateTimeValues
- parameters
application command line parameters.
- Type:
str
- username
username that scheduled the task.
- Type:
str
- working_directory
working directory of the scheduled task.
- Type:
str
- DATA_TYPE = 'windows:tasks:job'
- class plaso.parsers.winjob.WinJobParser[source]
Bases:
FileObjectParser
,DtFabricHelper
Parse Windows Scheduled Task files for job events.
- DATA_FORMAT = 'Windows Scheduled Task job (or at-job) file'
- NAME = 'winjob'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows job file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – a file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
- class plaso.parsers.winjob.WinJobTriggerEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Scheduled Task trigger event data.
- application
path to job executable.
- Type:
str
- comment
description of the scheduled task.
- Type:
str
- end_time
date and time the end of the trigger.
- Type:
dfdatetime.DateTimeValues
- parameters
application command line parameters.
- Type:
str
- start_time
date and time the start of the trigger.
- Type:
dfdatetime.DateTimeValues
- trigger_type
trigger type.
- Type:
int
- username
username that scheduled the task.
- Type:
str
- working_directory
working directory of the scheduled task.
- Type:
str
- DATA_TYPE = 'windows:tasks:trigger'
plaso.parsers.winlnk module
Parser for Windows Shortcut (LNK) files.
- class plaso.parsers.winlnk.WinLnkLinkEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Shortcut (LNK) link event data.
- access_time
file entry last access date and time.
- Type:
dfdatetime.DateTimeValues
- birth_droid_file_identifier
distributed link tracking birth droid file identifier.
- Type:
str
- birth_droid_volume_identifier
distributed link tracking birth droid volume identifier.
- Type:
str
- command_line_arguments
command line arguments.
- Type:
str
- creation_time
file entry creation date and time.
- Type:
dfdatetime.DateTimeValues
- description
description of the linked item.
- Type:
str
- drive_serial_number
drive serial number where the linked item resides.
- Type:
int
- drive_type
drive type where the linked item resided.
- Type:
str
- droid_file_identifier
distributed link tracking droid file identifier.
- Type:
str
- droid_volume_identifier
distributed link tracking droid volume identifier.
- Type:
str
- env_var_location
environment variables location.
- Type:
str
- file_attribute_flags
file attribute flags of the linked item.
- Type:
int
- file_size
size of the linked item.
- Type:
int
- icon_location
icon location.
- Type:
str
- link_target
shell item list of the link target.
- Type:
str
- local_path
local path of the linked item.
- Type:
str
- modification_time
file entry last modification date and time.
- Type:
dfdatetime.DateTimeValues
- network_path
local path of the linked item.
- Type:
str
- relative_path
relative path.
- Type:
str
- volume_label
volume label where the linked item resided.
- Type:
str
- working_directory
working directory.
- Type:
str
- DATA_TYPE = 'windows:lnk:link'
- class plaso.parsers.winlnk.WinLnkParser[source]
Bases:
FileObjectParser
Windows Shortcut (LNK) file parser.
- DATA_FORMAT = 'Windows Shortcut (LNK) file'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'lnk'
- ParseFileLNKFile(parser_mediator, file_object, display_name)[source]
Parses a Windows Shortcut (LNK) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
display_name (str) – display name.
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Shortcut (LNK) file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.winpca module
Parser for Windows Program Compatibility Assistant (PCA) log files.
- class plaso.parsers.winpca.WindowsPCABaseParser[source]
Bases:
DSVParser
Shared code for parsing Program Compatibility Assistant (PCA) log files.
- COLUMNS = ()
- DELIMITER = '|'
- VerifyRow(parser_mediator, row)[source]
Verifies if a line of the file is in the expected format.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- Returns:
True if this is the correct parser, False otherwise.
- Return type:
bool
- class plaso.parsers.winpca.WindowsPCADB0Parser[source]
Bases:
WindowsPCABaseParser
Parses Windows Program Compatibility Assistant DB0 log files.
- COLUMNS = ['datetime', 'run_status', 'program', 'description', 'vendor', 'version', 'program_id', 'exit_code']
- DATA_FORMAT = 'Windows PCA DB0 log file'
- NAME = 'winpca_db0'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- class plaso.parsers.winpca.WindowsPCADicParser[source]
Bases:
WindowsPCABaseParser
Parses the Windows Program Compatibility Assistant DIC log files.
- COLUMNS = ['program', 'datetime']
- DATA_FORMAT = 'Windows PCA DIC log file'
- NAME = 'winpca_dic'
- ParseRow(parser_mediator, row_offset, row)[source]
Parses a line of the log file and produces events.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
row_offset (int) – offset of the line from which the row was extracted.
row (dict[str, str]) – fields of a single row, as specified in COLUMNS.
- class plaso.parsers.winpca.WindowsPCAEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows PCA (Program Compatibility Assistant) event data.
- description
description of the executable.
- Type:
str
- executable
executable filename.
- Type:
str
- exit_code
final result of the execution.
- Type:
str
- last_execution_time
entry last execution date and time.
- Type:
dfdatetime.DateTimeValues
- program_identifier
program identifier.
- Type:
str
- run_status
execution status.
- Type:
str
- vendor
vendor of executed software.
- Type:
str
- version
version of executed software.
- Type:
str
- DATA_TYPE = 'windows:pca_log:entry'
plaso.parsers.winprefetch module
Parser for Windows Prefetch files.
- class plaso.parsers.winprefetch.WinPrefetchExecutionEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Prefetch event data.
- executable
executable filename.
- Type:
str
- format_version
format version.
- Type:
int
- last_run_time
executable (binary) last run date and time.
- Type:
dfdatetime.DateTimeValues
- mapped_files
mapped filenames.
- Type:
list[str]
- number_of_volumes
number of volumes.
- Type:
int
- path_hints
possible full paths to the executable.
- Type:
list[str]
- prefetch_hash
prefetch hash.
- Type:
int
- previous_run_times
previous executable (binary) run date and time.
- Type:
list[dfdatetime.DateTimeValues]
- run_count
run count.
- Type:
int
- volume_device_paths
volume device paths.
- Type:
list[str]
- volume_serial_numbers
volume serial numbers.
- Type:
list[int]
- DATA_TYPE = 'windows:prefetch:execution'
- class plaso.parsers.winprefetch.WinPrefetchParser[source]
Bases:
FileObjectParser
A parser for Windows Prefetch files.
- DATA_FORMAT = 'Windows Prefetch File (PF)'
- classmethod GetFormatSpecification()[source]
Retrieves the format specification.
- Returns:
format specification.
- Return type:
- NAME = 'prefetch'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Prefetch file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
plaso.parsers.winreg_parser module
Parser for Windows NT Registry (REGF) files.
- class plaso.parsers.winreg_parser.WinRegistryParser[source]
Bases:
FileObjectParser
Parses Windows NT Registry (REGF) files.
- DATA_FORMAT = 'Windows NT Registry (REGF) file'
- EnablePlugins(plugin_includes)[source]
Enables parser plugins.
- Parameters:
plugin_includes (set[str]) – names of the plugins to enable, where set([‘*’]) represents all plugins. Note the default plugin, if it exists, is always enabled and cannot be disabled.
- NAME = 'winreg'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Registry file-like object.
- Parameters:
parser_mediator (ParserMediator) – parser mediator.
file_object (dfvfs.FileIO) – a file-like object.
plaso.parsers.winrestore module
Parser for Windows Restore Point (rp.log) files.
- class plaso.parsers.winrestore.RestorePointEventData(*args: Any, **kwargs: Any)[source]
Bases:
EventData
Windows Restore Point event data.
- creation_time
creation date and time.
- Type:
dfdatetime.DateTimeValues
- description
description.
- Type:
str
- restore_point_event_type
restore point event type.
- Type:
str
- restore_point_type
restore point type.
- Type:
str
- sequence_number
sequence number.
- Type:
str
- DATA_TYPE = 'windows:restore_point:info'
- class plaso.parsers.winrestore.RestorePointLogParser[source]
Bases:
FileObjectParser
,DtFabricHelper
A parser for Windows Restore Point (rp.log) files.
- DATA_FORMAT = 'Windows Restore Point log (rp.log) file'
- FILTERS = frozenset({<plaso.parsers.interface.FileNameFileEntryFilter object>})
- NAME = 'rplog'
- ParseFileObject(parser_mediator, file_object)[source]
Parses a Windows Restore Point (rp.log) log file-like object.
- Parameters:
parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.
file_object (dfvfs.FileIO) – file-like object.
- Raises:
WrongParser – when the file cannot be parsed.
Module contents
This file imports Python modules that register parsers.