def _StreamBody(
self,
args: ApiGetCollectedTimelineArgs,
) -> api_call_handler_base.ApiBinaryStream:
client_id = str(args.client_id)
flow_id = str(args.flow_id)
opts = body.Opts()
opts.timestamp_subsecond_precision = args.body_opts.timestamp_subsecond_precision
opts.backslash_escape = args.body_opts.backslash_escape
opts.carriage_return_escape = args.body_opts.carriage_return_escape
opts.non_printable_escape = args.body_opts.non_printable_escape
if args.body_opts.HasField("inode_ntfs_file_reference_format"):
# If the field is set explicitly, we respect the choice no matter what
# filesystem we detected.
if args.body_opts.inode_ntfs_file_reference_format:
opts.inode_format = body.Opts.InodeFormat.NTFS_FILE_REFERENCE
else:
fstype = timeline.FilesystemType(client_id=client_id,
flow_id=flow_id)
if fstype is not None and fstype.lower() == "ntfs":
opts.inode_format = body.Opts.InodeFormat.NTFS_FILE_REFERENCE
entries = timeline.ProtoEntries(client_id=client_id, flow_id=flow_id)
content = body.Stream(entries, opts=opts)
filename = "timeline_{}.body".format(flow_id)
return api_call_handler_base.ApiBinaryStream(filename, content)
def _StreamBody(
self,
client_id: Text,
flow_id: Text,
) -> api_call_handler_base.ApiBinaryStream:
entries = timeline.ProtoEntries(client_id=client_id, flow_id=flow_id)
content = body.Stream(entries)
filename = "timeline_{}.body".format(flow_id)
return api_call_handler_base.ApiBinaryStream(filename, content)
def _Collect(self, root: bytes) -> Iterator[timeline_pb2.TimelineEntry]:
args = rdf_timeline.TimelineArgs(root=root)
flow_id = flow_test_lib.TestFlowHelper(
timeline_flow.TimelineFlow.__name__,
action_mocks.ActionMock(timeline_action.Timeline),
client_id=self.client_id,
creator=self.test_username,
args=args)
flow_test_lib.FinishAllFlowsOnClient(self.client_id)
return timeline_flow.ProtoEntries(client_id=self.client_id, flow_id=flow_id)
def _StreamBody(
self,
args: ApiGetCollectedTimelineArgs,
) -> api_call_handler_base.ApiBinaryStream:
client_id = str(args.client_id)
flow_id = str(args.flow_id)
opts = body.Opts()
opts.timestamp_subsecond_precision = args.body_opts.timestamp_subsecond_precision
opts.inode_ntfs_file_reference_format = args.body_opts.inode_ntfs_file_reference_format
opts.backslash_escape = args.body_opts.backslash_escape
entries = timeline.ProtoEntries(client_id=client_id, flow_id=flow_id)
content = body.Stream(entries, opts=opts)
filename = "timeline_{}.body".format(flow_id)
return api_call_handler_base.ApiBinaryStream(filename, content)