Source code for plaso.formatters.msie_webcache
# -*- coding: utf-8 -*-
"""The MSIE WebCache ESE database event formatters."""
from __future__ import unicode_literals
from plaso.formatters import interface
from plaso.formatters import manager
[docs]class MsieWebCacheContainerEventFormatter(interface.ConditionalEventFormatter):
"""Formatter for a MSIE WebCache ESE database Container_# table record."""
DATA_TYPE = 'msie:webcache:container'
FORMAT_STRING_PIECES = [
'URL: {url}',
'Redirect URL: {redirect_url}',
'Access count: {access_count}',
'Sync count: {sync_count}',
'Filename: {cached_filename}',
'File extension: {file_extension}',
'Cached file size: {cached_file_size}',
'Request headers: {request_headers}',
'Response headers: {response_headers}',
'Entry identifier: {entry_identifier}',
'Container identifier: {container_identifier}',
'Cache identifier: {cache_identifier}']
FORMAT_STRING_SHORT_PIECES = [
'URL: {url}']
SOURCE_LONG = 'MSIE WebCache container record'
SOURCE_SHORT = 'WEBHIST'
[docs]class MsieWebCacheContainersEventFormatter(interface.ConditionalEventFormatter):
"""Formatter for a MSIE WebCache ESE database Containers table record."""
DATA_TYPE = 'msie:webcache:containers'
FORMAT_STRING_PIECES = [
'Name: {name}',
'Directory: {directory}',
'Table: Container_{container_identifier}',
'Container identifier: {container_identifier}',
'Set identifier: {set_identifier}']
FORMAT_STRING_SHORT_PIECES = [
'Directory: {directory}']
SOURCE_LONG = 'MSIE WebCache containers record'
SOURCE_SHORT = 'WEBHIST'
[docs]class MsieWebCacheLeakFilesEventFormatter(interface.ConditionalEventFormatter):
"""Formatter for a MSIE WebCache ESE database LeakFiles table record."""
DATA_TYPE = 'msie:webcache:leak_file'
FORMAT_STRING_PIECES = [
'Filename: {cached_filename}',
'Leak identifier: {leak_identifier}']
FORMAT_STRING_SHORT_PIECES = [
'Filename: {cached_filename}']
SOURCE_LONG = 'MSIE WebCache partitions record'
SOURCE_SHORT = 'WEBHIST'
[docs]class MsieWebCachePartitionsEventFormatter(interface.ConditionalEventFormatter):
"""Formatter for a MSIE WebCache ESE database Partitions table record."""
DATA_TYPE = 'msie:webcache:partitions'
FORMAT_STRING_PIECES = [
'Partition identifier: {partition_identifier}',
'Partition type: {partition_type}',
'Directory: {directory}',
'Table identifier: {table_identifier}']
FORMAT_STRING_SHORT_PIECES = [
'Directory: {directory}']
SOURCE_LONG = 'MSIE WebCache partitions record'
SOURCE_SHORT = 'WEBHIST'
manager.FormattersManager.RegisterFormatters([
MsieWebCacheContainerEventFormatter, MsieWebCacheContainersEventFormatter,
MsieWebCacheLeakFilesEventFormatter, MsieWebCachePartitionsEventFormatter])