def _attributes(self):
vt = vtime(long(self.timestamp/1e6), TIME_UNIX)
vt.thisown = False
v_vt = Variant(vt)
#v_profile_dir = Variant(self.profile_dir())
v_data = Variant(self.data)
v_data1 = Variant(self.data1)
v_data2 = Variant(self.data2)
v_data3 = Variant(self.data3)
v_data4 = Variant(self.data4)
v_vt.thisown = False
#v_profile_dir.thisown = False
v_data.thisown = False
v_data1.thisown = False
v_data2.thisown = False
v_data3.thisown = False
v_data4.thisown = False
attr = VMap()
attr.thisown = False
#attr["profile directory"] = v_profile_dir
if (self.browser == 'firefox'):
if(self.extract == 'history'):
attr['accessed'] = v_vt
attr['visit count'] = v_data
attr['typed'] = v_data1
return attr
elif(self.extract == 'cookies'):
attr['name'] = v_data2
attr['cookie'] = v_data3
attr['accessed'] = v_vt
return attr
elif(self.extract == 'downloads'):
attr['url'] = v_data2
attr['location'] = v_data3
#attr['start'] = v_data2
attr['finished'] = v_vt
return attr
elif(self.extract == 'signons'):
attr['username'] = v_data2
attr['password'] = v_data3
return attr
elif(self.extract == 'formhistory'):
attr['input'] = v_data2
attr['times used'] = v_data3
attr['last used'] = v_vt
return attr
def _attributes(self):
vt = vtime(long(self.timestamp / 1e6), TIME_UNIX)
vt.thisown = False
v_vt = Variant(vt)
#v_profile_dir = Variant(self.profile_dir())
v_data = Variant(self.data)
v_data1 = Variant(self.data1)
v_data2 = Variant(self.data2)
v_data3 = Variant(self.data3)
v_data4 = Variant(self.data4)
v_vt.thisown = False
#v_profile_dir.thisown = False
v_data.thisown = False
v_data1.thisown = False
v_data2.thisown = False
v_data3.thisown = False
v_data4.thisown = False
attr = VMap()
attr.thisown = False
#attr["profile directory"] = v_profile_dir
if (self.browser == 'firefox'):
if (self.extract == 'history'):
attr['accessed'] = v_vt
attr['visit count'] = v_data
attr['typed'] = v_data1
return attr
elif (self.extract == 'cookies'):
attr['name'] = v_data2
attr['cookie'] = v_data3
attr['accessed'] = v_vt
return attr
elif (self.extract == 'downloads'):
attr['url'] = v_data2
attr['location'] = v_data3
#attr['start'] = v_data2
attr['finished'] = v_vt
return attr
elif (self.extract == 'signons'):
attr['username'] = v_data2
attr['password'] = v_data3
return attr
elif (self.extract == 'formhistory'):
attr['input'] = v_data2
attr['times used'] = v_data3
attr['last used'] = v_vt
return attr
def attributes(self, node): #metaexif.status(decoding exif')
attr = VMap()
attr.thisown = False
file = node.open()
tags = EXIF.process_file(file)
if len(tags) == 0:
v = Variant("no exif")
v.thisown = 0
attr["info"] = v
return attr
else:
sortedTags = {}
for tag in tags.keys():
if tag not in ('JPEGThumbnail', 'TIFFThumbnail', 'Filename', 'EXIF MakerNote'):
spaceidx = tag.find(" ")
ifd = tag[:spaceidx].strip()
if ifd == "Image":
ifd = "IFD 0 (Image)"
if ifd == "Thumbnail":
ifd = "IFD 1 (Thumbnail)"
key = tag[spaceidx:].strip()
val = None
if tags[tag].tag in dateTimeTags:
# Try converting from usual string format to vtime, or to string
# if it fails.
try:
vt = time.strptime(str(tags[tag]), '%Y:%m:%d %H:%M:%S')
val = vtime(vt.tm_year, vt.tm_mon, vt.tm_mday, vt.tm_hour, vt.tm_min, vt.tm_sec, 0)
val.thisown = False
except ValueError:
pass
if not val:
try:
val = str(tags[tag])
except:
val = "cannot be decoded"
if ifd not in sortedTags.keys():
sortedTags[ifd] = []
sortedTags[ifd].append((key, val))
for ifd in sortedTags.keys():
m = VMap()
m.thisown = 0
for res in sortedTags[ifd]:
v = Variant(res[1])
v.thisown = False
m[res[0]] = v
vv = Variant(m)
vv.thisown = False
attr[ifd] = vv
return attr
def createdTime(self):
vt = vtime()
vt.thisown = False
epoch = 116444736000000000L
sec = (self.timestamp - epoch) / 10000000
t = time.gmtime(sec)
vt.year = t.tm_year
vt.month = t.tm_mon
vt.day = t.tm_mday
vt.hour = t.tm_hour
vt.min = t.tm_min
vt.sec = t.tm_sec
vt.wday = t.tm_wday
vt.yday = t.tm_yday
vt.dst = 0
return vt
def _attributes(self):
attr = VMap()
zipattr = self.reader.zipcontent.getinfo(self.zipfile)
for key in ZipNode.__slots__:
val = getattr(zipattr, key)
if key != "date_time":
vval = Variant(val)
vval.thisown = False
attr[key] = vval
vt = vtime()
vt.thisown = False
vt.year = zipattr.date_time[0]
vt.month = zipattr.date_time[1]
vt.day = zipattr.date_time[2]
vt.hour = zipattr.date_time[3]
vt.minute = zipattr.date_time[4]
vt.second = zipattr.date_time[5]
vvt = Variant(vt)
vvt.thisown = False
attr["create"] = vvt
return attr
def _attributes(self):
attr = VMap()
attr.thisown = False
if self.pid != None:
pidattr = Variant(self.pid)
pidattr.thisown = False
attr["pid"] = pidattr
if self.active_threads:
atattr = Variant(self.active_threads)
atattr.thisown = False
attr["threads"] = atattr
if self.inherited_from:
ifattr = Variant(self.inherited_from)
ifattr.thisown = False
attr["ppid"] = ifattr
if self.handle_count:
hcattr = Variant(self.handle_count)
hcattr.thisown = False
attr["handle count"] = hcattr
if self.connections:
cnattr = Variant(self.connections)
cnattr.thisown = False
attr["connection"] = cnattr
if self.create_time:
at = vtime()
at.thisown = False
d = datetime.fromtimestamp(self.create_time).timetuple()
at.year = d[0]
at.month = d[1]
at.day = d[2]
at.hour = d[3]
at.minute = d[4]
at.second = d[5]
at.usecond = 0
vat = Variant(at)
vat.thisown = False
attr["creation"] = vat
return attr
