plaso.parsers.shared package¶
Submodules¶
plaso.parsers.shared.shell_items module¶
Parser for Windows NT shell items.
-
class
plaso.parsers.shared.shell_items.
ShellItemsParser
(origin)[source]¶ Bases:
object
Parses for Windows NT shell items.
-
CopyToPath
()[source]¶ Copies the shell items to a path.
Returns: converted shell item list path or None. Return type: str
-
GetUpperPathSegment
()[source]¶ Retrieves the upper shell item path segment.
Returns: shell item path segment or “N/A”. Return type: str
-
NAME
= 'shell_items'¶
-
ParseByteStream
(parser_mediator, byte_stream, parent_path_segments=None, codepage='cp1252')[source]¶ Parses the shell items from the byte stream.
Parameters: - parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfvfs.
- byte_stream (bytes) – shell items data.
- parent_path_segments (Optional[list[str]]) – parent shell item path segments.
- codepage (Optional[str]) – byte stream codepage.
-