class WinEventLog:
"""WinEventLog class.
Allows to retrieve the Events contained within Windows Event Log files.
"""
def __init__(self, disk):
self._disk = disk
self._filesystem = None
self.logger = logging.getLogger(
"%s.%s" % (self.__module__, self.__class__.__name__))
def __enter__(self):
self._filesystem = FileSystem(self._disk)
self._filesystem.mount()
return self
def __exit__(self, *_):
self._filesystem.umount()
def __getattr__(self, attr):
return getattr(self._filesystem, attr)
def eventlog(self, path):
"""Iterates over the Events contained within the log at the given path.
For each Event, yields a XML string.
"""
self.logger.debug("Parsing Event log file %s.", path)
with NamedTemporaryFile(buffering=0) as tempfile:
self._filesystem.download(path, tempfile.name)
file_header = FileHeader(tempfile.read(), 0)
for xml_string, _ in evtx_file_xml_view(file_header):
yield xml_string
