def GetFileMACTimesFromFileRecord(self, v):
times = { 'c_time':None, 'm_time':None, 'cr_time':None, 'a_time':None }
catalog_file = v.data
times['c_time'] = CommonFunctions.ReadMacHFSTime(catalog_file.attributeModDate)
times['m_time'] = CommonFunctions.ReadMacHFSTime(catalog_file.contentModDate)
times['cr_time'] = CommonFunctions.ReadMacHFSTime(catalog_file.createDate)
times['a_time'] = CommonFunctions.ReadMacHFSTime(catalog_file.accessDate)
return times
def ProcessMRU(office_items, app_name, mru_list, user, source):
for mru in mru_list:
try:
access_data = mru.get('Access Date', '')
access_time = None
try:
v = struct.unpack('<I', access_data[2:6])[0]
access_time = CommonFunctions.ReadMacHFSTime(v)
except (IndexError, ValueError):
log.exception('')
path = ''
alias_data = mru.get('File Alias', None)
if alias_data:
try:
alias_properties = next(
AliasParser.parse(source, 0, alias_data))
#log.debug(alias_properties)
path = alias_properties.get('path', '')
except (IndexError, ValueError, KeyError, TypeError):
log.exception('')
o_item = MSOfficeItem(app_name, access_time, 'MRU', path, '',
user, source)
office_items.append(o_item)
except (ValueError, TypeError):
log.exception('')
def __init__(self, file_label, parent_mod_date, file_mod_date, recent_used,
file_type, file_data, guid, user, source_path):
self.file_label = file_label
if parent_mod_date and (parent_mod_date >
0xFFFFFFFF): # On High Sierra and above..
parent_mod_date = parent_mod_date & 0xFFFFFFFF # Killing upper 32 bits!
# Upper 32 bits maybe the finer resolution (microseconds?).
if file_mod_date and (file_mod_date >
0xFFFFFFFF): # On High Sierra and above..
file_mod_date = file_mod_date & 0xFFFFFFFF # Killing upper 32 bits!
self.parent_mod_date = CommonFunctions.ReadMacHFSTime(parent_mod_date)
self.file_mod_date = CommonFunctions.ReadMacHFSTime(file_mod_date)
self.recent_used = recent_used
self.file_type = file_type
self.file_path = file_data
self.guid = guid
self.user = user
self.path = source_path
