plaso.parsers.shared package

Submodules

plaso.parsers.shared.shell_items module

Parser for Windows NT shell items.

class plaso.parsers.shared.shell_items.ShellItemsParser(origin)[source]

Bases: object

Parses for Windows NT shell items.

CopyToPath()[source]

Copies the shell items to a path.

Returns

converted shell item list path or None.

Return type

str

GetUpperPathSegment()[source]

Retrieves the upper shell item path segment.

Returns

shell item path segment or “N/A”.

Return type

str

NAME = 'shell_items'
ParseByteStream(parser_mediator, byte_stream, parent_path_segments=None, codepage='cp1252')[source]

Parses the shell items from the byte stream.

Parameters

  • parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.

  • byte_stream (bytes) – shell items data.

  • parent_path_segments (Optional[list[str]]) – parent shell item path segments.

  • codepage (Optional[str]) – byte stream codepage.

Module contents