Source code for plaso.formatters.tango_android

# -*- coding: utf-8 -*-
"""Tango on Android databases formatter."""

from __future__ import unicode_literals

from plaso.formatters import interface
from plaso.formatters import manager
from plaso.lib import errors


[docs]class TangoAndroidMessageFormatter(interface.ConditionalEventFormatter): """Tango on Android message event formatter.""" DATA_TYPE = 'tango:android:message' FORMAT_STRING_PIECES = [ '{direction}', 'Message ({message_identifier})', ] FORMAT_STRING_SHORT_PIECES = [ '{direction}', 'Message ({message_identifier})' ] SOURCE_LONG = 'Tango Android Message' SOURCE_SHORT = 'Tango Android' _DIRECTION = { 1: 'Incoming', 2: 'Outgoing' } # pylint: disable=unused-argument
[docs] def GetMessages(self, formatter_mediator, event): """Determines the formatted message strings for an event. Args: formatter_mediator (FormatterMediator): mediates the interactions between formatters and other components, such as storage and Windows EventLog resources. event (EventObject): event. Returns: tuple[str, str]: formatted message string and short message string. Raises: WrongFormatter: if the event object cannot be formatted by the formatter. """ if self.DATA_TYPE != event.data_type: raise errors.WrongFormatter('Unsupported data type: {0:s}.'.format( event.data_type)) event_values = event.CopyToDict() direction = event_values.get('direction', None) if direction is not None: event_values['direction'] = self._DIRECTION.get(direction, 'Unknown')
return self._ConditionalFormatMessages(event_values)
[docs]class TangoAndroidConversationFormatter(interface.ConditionalEventFormatter): """Tango on Android conversation event formatter.""" DATA_TYPE = 'tango:android:conversation' FORMAT_STRING_PIECES = [ 'Conversation ({conversation_identifier})', ] FORMAT_STRING_SHORT_PIECES = [ 'Conversation ({conversation_identifier})', ] SOURCE_LONG = 'Tango Android Conversation'
SOURCE_SHORT = 'Tango Android'
[docs]class TangoAndroidContactFormatter(interface.ConditionalEventFormatter): """Tango on Android contact event formatter.""" DATA_TYPE = 'tango:android:contact' FORMAT_STRING_PIECES = [ '{first_name}', '{last_name}', '{gender}', 'birthday: {birthday}', 'Status: {status}', 'Friend: {is_friend}', 'Request type: {friend_request_type}', 'Request message: {friend_request_message}' ] FORMAT_STRING_SHORT_PIECES = [ '{first_name}', '{last_name}', 'Status: {status}' ] SOURCE_LONG = 'Tango Android Contact' SOURCE_SHORT = 'Tango Android' # pylint: disable=unused-argument
[docs] def GetMessages(self, formatter_mediator, event): """Determines the formatted message strings for an event. Args: formatter_mediator (FormatterMediator): mediates the interactions between formatters and other components, such as storage and Windows EventLog resources. event (EventObject): event. Returns: tuple[str, str]: formatted message string and short message string. Raises: WrongFormatter: if the event object cannot be formatted by the formatter. """ if self.DATA_TYPE != event.data_type: raise errors.WrongFormatter('Unsupported data type: {0:s}.'.format( event.data_type)) event_values = event.CopyToDict() is_friend = event_values.get('is_friend', None) if is_friend is not None: event_values['is_friend'] = '{0!s}'.format(is_friend)
return self._ConditionalFormatMessages(event_values) manager.FormattersManager.RegisterFormatters([ TangoAndroidMessageFormatter, TangoAndroidConversationFormatter, TangoAndroidContactFormatter])