def _attributes(self): vt = vtime(long(self.timestamp/1e6), TIME_UNIX) vt.thisown = False v_vt = Variant(vt) #v_profile_dir = Variant(self.profile_dir()) v_data = Variant(self.data) v_data1 = Variant(self.data1) v_data2 = Variant(self.data2) v_data3 = Variant(self.data3) v_data4 = Variant(self.data4) v_vt.thisown = False #v_profile_dir.thisown = False v_data.thisown = False v_data1.thisown = False v_data2.thisown = False v_data3.thisown = False v_data4.thisown = False attr = VMap() attr.thisown = False #attr["profile directory"] = v_profile_dir if (self.browser == 'firefox'): if(self.extract == 'history'): attr['accessed'] = v_vt attr['visit count'] = v_data attr['typed'] = v_data1 return attr elif(self.extract == 'cookies'): attr['name'] = v_data2 attr['cookie'] = v_data3 attr['accessed'] = v_vt return attr elif(self.extract == 'downloads'): attr['url'] = v_data2 attr['location'] = v_data3 #attr['start'] = v_data2 attr['finished'] = v_vt return attr elif(self.extract == 'signons'): attr['username'] = v_data2 attr['password'] = v_data3 return attr elif(self.extract == 'formhistory'): attr['input'] = v_data2 attr['times used'] = v_data3 attr['last used'] = v_vt return attr
def _attributes(self): vt = vtime(long(self.timestamp / 1e6), TIME_UNIX) vt.thisown = False v_vt = Variant(vt) #v_profile_dir = Variant(self.profile_dir()) v_data = Variant(self.data) v_data1 = Variant(self.data1) v_data2 = Variant(self.data2) v_data3 = Variant(self.data3) v_data4 = Variant(self.data4) v_vt.thisown = False #v_profile_dir.thisown = False v_data.thisown = False v_data1.thisown = False v_data2.thisown = False v_data3.thisown = False v_data4.thisown = False attr = VMap() attr.thisown = False #attr["profile directory"] = v_profile_dir if (self.browser == 'firefox'): if (self.extract == 'history'): attr['accessed'] = v_vt attr['visit count'] = v_data attr['typed'] = v_data1 return attr elif (self.extract == 'cookies'): attr['name'] = v_data2 attr['cookie'] = v_data3 attr['accessed'] = v_vt return attr elif (self.extract == 'downloads'): attr['url'] = v_data2 attr['location'] = v_data3 #attr['start'] = v_data2 attr['finished'] = v_vt return attr elif (self.extract == 'signons'): attr['username'] = v_data2 attr['password'] = v_data3 return attr elif (self.extract == 'formhistory'): attr['input'] = v_data2 attr['times used'] = v_data3 attr['last used'] = v_vt return attr
def attributes(self, node): #metaexif.status(decoding exif') attr = VMap() attr.thisown = False file = node.open() tags = EXIF.process_file(file) if len(tags) == 0: v = Variant("no exif") v.thisown = 0 attr["info"] = v return attr else: sortedTags = {} for tag in tags.keys(): if tag not in ('JPEGThumbnail', 'TIFFThumbnail', 'Filename', 'EXIF MakerNote'): spaceidx = tag.find(" ") ifd = tag[:spaceidx].strip() if ifd == "Image": ifd = "IFD 0 (Image)" if ifd == "Thumbnail": ifd = "IFD 1 (Thumbnail)" key = tag[spaceidx:].strip() val = None if tags[tag].tag in dateTimeTags: # Try converting from usual string format to vtime, or to string # if it fails. try: vt = time.strptime(str(tags[tag]), '%Y:%m:%d %H:%M:%S') val = vtime(vt.tm_year, vt.tm_mon, vt.tm_mday, vt.tm_hour, vt.tm_min, vt.tm_sec, 0) val.thisown = False except ValueError: pass if not val: try: val = str(tags[tag]) except: val = "cannot be decoded" if ifd not in sortedTags.keys(): sortedTags[ifd] = [] sortedTags[ifd].append((key, val)) for ifd in sortedTags.keys(): m = VMap() m.thisown = 0 for res in sortedTags[ifd]: v = Variant(res[1]) v.thisown = False m[res[0]] = v vv = Variant(m) vv.thisown = False attr[ifd] = vv return attr
def createdTime(self): vt = vtime() vt.thisown = False epoch = 116444736000000000L sec = (self.timestamp - epoch) / 10000000 t = time.gmtime(sec) vt.year = t.tm_year vt.month = t.tm_mon vt.day = t.tm_mday vt.hour = t.tm_hour vt.min = t.tm_min vt.sec = t.tm_sec vt.wday = t.tm_wday vt.yday = t.tm_yday vt.dst = 0 return vt
def _attributes(self): attr = VMap() zipattr = self.reader.zipcontent.getinfo(self.zipfile) for key in ZipNode.__slots__: val = getattr(zipattr, key) if key != "date_time": vval = Variant(val) vval.thisown = False attr[key] = vval vt = vtime() vt.thisown = False vt.year = zipattr.date_time[0] vt.month = zipattr.date_time[1] vt.day = zipattr.date_time[2] vt.hour = zipattr.date_time[3] vt.minute = zipattr.date_time[4] vt.second = zipattr.date_time[5] vvt = Variant(vt) vvt.thisown = False attr["create"] = vvt return attr
def _attributes(self): attr = VMap() attr.thisown = False if self.pid != None: pidattr = Variant(self.pid) pidattr.thisown = False attr["pid"] = pidattr if self.active_threads: atattr = Variant(self.active_threads) atattr.thisown = False attr["threads"] = atattr if self.inherited_from: ifattr = Variant(self.inherited_from) ifattr.thisown = False attr["ppid"] = ifattr if self.handle_count: hcattr = Variant(self.handle_count) hcattr.thisown = False attr["handle count"] = hcattr if self.connections: cnattr = Variant(self.connections) cnattr.thisown = False attr["connection"] = cnattr if self.create_time: at = vtime() at.thisown = False d = datetime.fromtimestamp(self.create_time).timetuple() at.year = d[0] at.month = d[1] at.day = d[2] at.hour = d[3] at.minute = d[4] at.second = d[5] at.usecond = 0 vat = Variant(at) vat.thisown = False attr["creation"] = vat return attr