LEFT | RIGHT |
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """This file contains a parser for the Mac OS X application usage. | 2 """This file contains a parser for the Mac OS X application usage. |
3 | 3 |
4 The application usage is stored in SQLite database files named | 4 The application usage is stored in SQLite database files named |
5 /var/db/application_usage.sqlite | 5 /var/db/application_usage.sqlite |
6 """ | 6 """ |
7 | 7 |
8 from dfdatetime import posix_time as dfdatetime_posix_time | 8 from dfdatetime import posix_time as dfdatetime_posix_time |
9 | 9 |
10 from plaso.containers import events | 10 from plaso.containers import events |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 | 55 |
56 # Define the needed queries. | 56 # Define the needed queries. |
57 QUERIES = [( | 57 QUERIES = [( |
58 (u'SELECT last_time, event, bundle_id, app_version, app_path, ' | 58 (u'SELECT last_time, event, bundle_id, app_version, app_path, ' |
59 u'number_times FROM application_usage ORDER BY last_time'), | 59 u'number_times FROM application_usage ORDER BY last_time'), |
60 u'ParseApplicationUsageRow')] | 60 u'ParseApplicationUsageRow')] |
61 | 61 |
62 # The required tables. | 62 # The required tables. |
63 REQUIRED_TABLES = frozenset([u'application_usage']) | 63 REQUIRED_TABLES = frozenset([u'application_usage']) |
64 | 64 |
65 SCHEMAS = [ | 65 SCHEMAS = [{ |
66 {u'application_usage': | 66 u'application_usage': ( |
67 u'CREATE TABLE application_usage (event TEXT,bundle_id ' | 67 u'CREATE TABLE application_usage (event TEXT, bundle_id TEXT, ' |
68 u'TEXT,app_version TEXT,app_path TEXT,last_time INTEGER DEFAULT ' | 68 u'app_version TEXT, app_path TEXT, last_time INTEGER DEFAULT 0, ' |
69 u'0,number_times INTEGER DEFAULT 0,PRIMARY KEY (event, bundle_id))'}] | 69 u'number_times INTEGER DEFAULT 0, PRIMARY KEY (event, bundle_id))')}] |
70 | 70 |
71 def ParseApplicationUsageRow( | 71 def ParseApplicationUsageRow( |
72 self, parser_mediator, row, query=None, **unused_kwargs): | 72 self, parser_mediator, row, query=None, **unused_kwargs): |
73 """Parses an application usage row. | 73 """Parses an application usage row. |
74 | 74 |
75 Args: | 75 Args: |
76 parser_mediator (ParserMediator): mediates interactions between parsers | 76 parser_mediator (ParserMediator): mediates interactions between parsers |
77 and other components, such as storage and dfvfs. | 77 and other components, such as storage and dfvfs. |
78 row (sqlite3.Row): row. | 78 row (sqlite3.Row): row. |
79 query (Optional[str]): query. | 79 query (Optional[str]): query. |
(...skipping 11 matching lines...) Expand all Loading... |
91 event_data.bundle_id = row['bundle_id'] | 91 event_data.bundle_id = row['bundle_id'] |
92 event_data.count = row['number_times'] | 92 event_data.count = row['number_times'] |
93 event_data.query = query | 93 event_data.query = query |
94 | 94 |
95 date_time = dfdatetime_posix_time.PosixTime(timestamp=row['last_time']) | 95 date_time = dfdatetime_posix_time.PosixTime(timestamp=row['last_time']) |
96 event = time_events.DateTimeValuesEvent(date_time, usage) | 96 event = time_events.DateTimeValuesEvent(date_time, usage) |
97 parser_mediator.ProduceEventWithEventData(event, event_data) | 97 parser_mediator.ProduceEventWithEventData(event, event_data) |
98 | 98 |
99 | 99 |
100 sqlite.SQLiteParser.RegisterPlugin(ApplicationUsagePlugin) | 100 sqlite.SQLiteParser.RegisterPlugin(ApplicationUsagePlugin) |
LEFT | RIGHT |