plaso.storage.fake package

Submodules

plaso.storage.fake.writer module

Fake storage writer for testing.

class plaso.storage.fake.writer.FakeStorageWriter(session, storage_type=u'session', task=None)

Bases: plaso.storage.interface.StorageWriter

Fake storage writer object.

analysis_reports

list[AnalysisReport] – analysis reports.

session_completion

SessionCompletion – session completion attribute container.

session_start

SessionStart – session start attribute container.

task_completion

TaskCompletion – task completion attribute container.

task_start

TaskStart – task start attribute container.

AddAnalysisReport(analysis_report)

Adds an analysis report.

Parameters:analysis_report (AnalysisReport) – analysis report. Raises:IOError – when the storage writer is closed.

AddError(error)

Adds an error.

Parameters:error (ExtractionError) – error. Raises:IOError – when the storage writer is closed.

AddEvent(event)

Adds an event.

Parameters:event (EventObject) – event. Raises:IOError – when the storage writer is closed or if the event data identifier type is not supported.

AddEventData(event_data)

Adds event data.

Parameters:event_data (EventData) – event data. Raises:IOError – when the storage writer is closed.

AddEventSource(event_source)

Adds an event source.

Parameters:event_source (EventSource) – event source. Raises:IOError – when the storage writer is closed.

AddEventTag(event_tag)

Adds an event tag.

Parameters:event_tag (EventTag) – event tag. Raises:IOError – when the storage writer is closed.

Close()

Closes the storage writer.

Raises:IOError – when the storage writer is closed.

CreateTaskStorage(task)

Creates a task storage.

Parameters:task (Task) – task. Returns:storage writer. Return type:FakeStorageWriter Raises:IOError – if the task storage already exists.

GetErrors()

Retrieves the errors.

Returns:error generator. Return type:generator(ExtractionError)

GetEventData()

Retrieves the event data.

Returns:event data generator. Return type:generator(EventData)

GetEventSources()

Retrieves the event sources.

Returns:event source generator. Return type:generator(EventSource)

GetEventTags()

Retrieves the event tags.

Returns:event tag generator. Return type:generator(EventTags)

GetEvents()

Retrieves the events.

Yields:EventObject – event.

GetFirstWrittenEventSource()

Retrieves the first event source that was written after open.

Using GetFirstWrittenEventSource and GetNextWrittenEventSource newly added event sources can be retrieved in order of addition.

Returns:event source or None if there are no newly written ones. Return type:EventSource Raises:IOError – when the storage writer is closed.

GetNextWrittenEventSource()

Retrieves the next event source that was written after open.

Returns:event source or None if there are no newly written ones. Return type:EventSource Raises:IOError – when the storage writer is closed.

GetSortedEvents(time_range=None)

Retrieves the events in increasing chronological order.

Parameters:time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period. Returns:event generator. Return type:generator(EventObject) Raises:IOError – when the storage writer is closed.

Open()

Opens the storage writer.

Raises:IOError – if the storage writer is already opened.

PrepareMergeTaskStorage(task)

Prepares a task storage for merging.

Parameters:task (Task) – task. Raises:IOError – if the task storage does not exist.

ReadPreprocessingInformation(unused_knowledge_base)

Reads preprocessing information.

The preprocessing information contains the system configuration which contains information about various system specific configuration data, for example the user accounts.

Parameters:knowledge_base (KnowledgeBase) – is used to store the preprocessing information. Raises:IOError – if the storage type does not support writing preprocessing information or when the storage writer is closed.

SetSerializersProfiler(serializers_profiler)

Sets the serializers profiler.

Parameters:serializers_profiler (SerializersProfiler) – serializers profile.

WritePreprocessingInformation(unused_knowledge_base)

Writes preprocessing information.

Parameters:knowledge_base (KnowledgeBase) – contains the preprocessing information. Raises:IOError – if the storage type does not support writing preprocessing information or when the storage writer is closed.

WriteSessionCompletion(aborted=False)

Writes session completion information.

Parameters:aborted (Optional[bool]) – True if the session was aborted. Raises:IOError – if the storage type does not support writing a session completion or when the storage writer is closed.

WriteSessionStart()

Writes session start information.

Raises:IOError – if the storage type does not support writing a session start or when the storage writer is closed.

WriteTaskCompletion(aborted=False)

Writes task completion information.

Parameters:aborted (Optional[bool]) – True if the session was aborted. Raises:IOError – if the storage type does not support writing a task completion or when the storage writer is closed.

WriteTaskStart()

Writes task start information.

Raises:IOError – if the storage type does not support writing a task start or when the storage writer is closed.

Module contents