Ejemplo n.º 1
0
def main():
    args_parser = argparse.ArgumentParser(description="Tests get_version.")

    options = args_parser.parse_args()

    try:
        pyevtx.get_version()
    except Exception:
        return False

    return True
Ejemplo n.º 2
0
def main():
  args_parser = argparse.ArgumentParser(
      description="Tests get_version.")

  options = args_parser.parse_args()

  try:
    pyevtx.get_version()
  except Exception:
    return False

  return True
Ejemplo n.º 3
0
def PrintHeader(options):
  """Print header information, including library versions."""
  print frontend_utils.FormatHeader('File Parsed')
  print u'{:>20s}'.format(options.file_to_parse)

  print frontend_utils.FormatHeader('Versions')
  print frontend_utils.FormatOutputString('plaso engine', plaso.GetVersion())
  print frontend_utils.FormatOutputString('pyevt', pyevt.get_version())
  print frontend_utils.FormatOutputString('pyevtx', pyevtx.get_version())
  print frontend_utils.FormatOutputString('pylnk', pylnk.get_version())
  print frontend_utils.FormatOutputString('pymsiecf', pymsiecf.get_version())
  print frontend_utils.FormatOutputString('pyregf', pyregf.get_version())

  if options.filter:
    print frontend_utils.FormatHeader('Filter Used')
    print frontend_utils.FormatOutputString('Filter String', options.filter)

  if options.parsers:
    print frontend_utils.FormatHeader('Parser Filter Used')
    print frontend_utils.FormatOutputString('Parser String', options.parsers)
Ejemplo n.º 4
0
def PrintHeader(options):
    """Print header information, including library versions."""
    print frontend_utils.FormatHeader('File Parsed')
    print u'{:>20s}'.format(options.file_to_parse)

    print frontend_utils.FormatHeader('Versions')
    print frontend_utils.FormatOutputString('plaso engine', plaso.GetVersion())
    print frontend_utils.FormatOutputString('pyevt', pyevt.get_version())
    print frontend_utils.FormatOutputString('pyevtx', pyevtx.get_version())
    print frontend_utils.FormatOutputString('pylnk', pylnk.get_version())
    print frontend_utils.FormatOutputString('pymsiecf', pymsiecf.get_version())
    print frontend_utils.FormatOutputString('pyregf', pyregf.get_version())

    if options.filter:
        print frontend_utils.FormatHeader('Filter Used')
        print frontend_utils.FormatOutputString('Filter String',
                                                options.filter)

    if options.parsers:
        print frontend_utils.FormatHeader('Parser Filter Used')
        print frontend_utils.FormatOutputString('Parser String',
                                                options.parsers)
Ejemplo n.º 5
0
 def test_get_version(self):
     """Tests the get_version function."""
     version = pyevtx.get_version()
Ejemplo n.º 6
0
# -*- coding: utf-8 -*-
"""Parser for Windows XML EventLog (EVTX) files."""

import logging

import pyevtx

from plaso.events import time_events
from plaso.lib import errors
from plaso.lib import eventdata
from plaso.parsers import interface
from plaso.parsers import manager

if pyevtx.get_version() < '20141112':
    raise ImportWarning('WinEvtxParser requires at least pyevtx 20141112.')


class WinEvtxRecordEvent(time_events.FiletimeEvent):
    """Convenience class for a Windows XML EventLog (EVTX) record event."""
    DATA_TYPE = 'windows:evtx:record'

    def __init__(self, evtx_record, recovered=False):
        """Initializes the event.

    Args:
      evtx_record: The EVTX record (pyevtx.record).
      recovered: Boolean value to indicate the record was recovered, False
                 by default.
    """
        try:
            timestamp = evtx_record.get_written_time_as_integer()
Ejemplo n.º 7
0
 def test_get_version(self):
   """Tests the get_version function."""
   version = pyevtx.get_version()
Ejemplo n.º 8
0
# -*- coding: utf-8 -*-
"""Parser for Windows XML EventLog (EVTX) files."""

import logging

import pyevtx

from plaso.events import time_events
from plaso.lib import errors
from plaso.lib import eventdata
from plaso.parsers import interface
from plaso.parsers import manager


if pyevtx.get_version() < '20141112':
  raise ImportWarning('WinEvtxParser requires at least pyevtx 20141112.')


class WinEvtxRecordEvent(time_events.FiletimeEvent):
  """Convenience class for a Windows XML EventLog (EVTX) record event."""
  DATA_TYPE = 'windows:evtx:record'

  def __init__(self, evtx_record, recovered=False):
    """Initializes the event.

    Args:
      evtx_record: The EVTX record (pyevtx.record).
      recovered: Boolean value to indicate the record was recovered, False
                 by default.
    """
    try:
Ejemplo n.º 9
0
 def test_get_version(self):
     """Tests the get_version function."""
     version = pyevtx.get_version()
     self.assertIsNotNone(version)