Code updated.
https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py File plaso/storage/zip_file.py (right): https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:1835: old_tag = self._ReadEventTag(data_stream) Add note about tag write, cache invalidation.
LGTM, minor comments. https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py File plaso/storage/zip_file.py (right): https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:702: # TODO: determine if else needs to be handled here. +anything https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:1186: self._pre_obj.counter[attributes.get(u'parser', u'N/A')] += 1 Add todo to remove plugin, add parser chain. I also think this should be moved to a separate method to modularize this code a little more - UpdateEventCounters or something. https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:1427: report_string = file_object.read(self.MAXIMUM_REPORT_PROTOBUF_SIZE) not report_data or report_bytes?
https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py File plaso/storage/zip_file.py (right): https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:702: # TODO: determine if else needs to be handled here. On 2015/10/13 09:36:45, onager wrote: > +anything Done. https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:1186: self._pre_obj.counter[attributes.get(u'parser', u'N/A')] += 1 On 2015/10/13 09:36:45, onager wrote: > Add todo to remove plugin, add parser chain. I also think this should be moved > to a separate method to modularize this code a little more - UpdateEventCounters > or something. Done. https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:1427: report_string = file_object.read(self.MAXIMUM_REPORT_PROTOBUF_SIZE) On 2015/10/13 09:36:45, onager wrote: > not report_data or report_bytes? leaving as-is https://codereview.appspot.com/267260043/diff/20001/plaso/storage/zip_file.py... plaso/storage/zip_file.py:1835: old_tag = self._ReadEventTag(data_stream) On 2015/10/09 09:45:09, Joachim Metz wrote: > Add note about tag write, cache invalidation. Done.