LEFT | RIGHT |
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """This file contains a parser for the Mac OS X MacKeeper cache database.""" | 2 """This file contains a parser for the Mac OS X MacKeeper cache database.""" |
3 | 3 |
4 import codecs | 4 import codecs |
5 import json | 5 import json |
6 | 6 |
7 from dfdatetime import java_time as dfdatetime_java_time | 7 from dfdatetime import java_time as dfdatetime_java_time |
8 | 8 |
9 from plaso.containers import events | 9 from plaso.containers import events |
10 from plaso.containers import time_events | 10 from plaso.containers import time_events |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 u'SELECT d.entry_ID AS id, d.receiver_data AS data, r.request_key, ' | 55 u'SELECT d.entry_ID AS id, d.receiver_data AS data, r.request_key, ' |
56 u'r.time_stamp AS time_string FROM cfurl_cache_receiver_data d, ' | 56 u'r.time_stamp AS time_string FROM cfurl_cache_receiver_data d, ' |
57 u'cfurl_cache_response r WHERE r.entry_ID = ' | 57 u'cfurl_cache_response r WHERE r.entry_ID = ' |
58 u'd.entry_ID'), u'ParseReceiverData')] | 58 u'd.entry_ID'), u'ParseReceiverData')] |
59 | 59 |
60 # The required tables. | 60 # The required tables. |
61 REQUIRED_TABLES = frozenset([ | 61 REQUIRED_TABLES = frozenset([ |
62 u'cfurl_cache_blob_data', u'cfurl_cache_receiver_data', | 62 u'cfurl_cache_blob_data', u'cfurl_cache_receiver_data', |
63 u'cfurl_cache_response']) | 63 u'cfurl_cache_response']) |
64 | 64 |
65 SCHEMAS = [ | 65 SCHEMAS = [{ |
66 {u'cfurl_cache_blob_data': | 66 u'cfurl_cache_blob_data': ( |
67 u'CREATE TABLE cfurl_cache_blob_data(entry_ID INTEGER PRIMARY KEY, ' | 67 u'CREATE TABLE cfurl_cache_blob_data(entry_ID INTEGER PRIMARY KEY, ' |
68 u'response_object BLOB, request_object BLOB, proto_props BLOB, ' | 68 u'response_object BLOB, request_object BLOB, proto_props BLOB, ' |
69 u'user_info BLOB)', | 69 u'user_info BLOB)'), |
70 u'cfurl_cache_receiver_data': | 70 u'cfurl_cache_receiver_data': ( |
71 u'CREATE TABLE cfurl_cache_receiver_data(entry_ID INTEGER PRIMARY ' | 71 u'CREATE TABLE cfurl_cache_receiver_data(entry_ID INTEGER PRIMARY ' |
72 u'KEY, receiver_data BLOB)', | 72 u'KEY, receiver_data BLOB)'), |
73 u'cfurl_cache_response': | 73 u'cfurl_cache_response': ( |
74 u'CREATE TABLE cfurl_cache_response(entry_ID INTEGER PRIMARY KEY ' | 74 u'CREATE TABLE cfurl_cache_response(entry_ID INTEGER PRIMARY KEY ' |
75 u'AUTOINCREMENT UNIQUE, version INTEGER, hash_value INTEGER, ' | 75 u'AUTOINCREMENT UNIQUE, version INTEGER, hash_value INTEGER, ' |
76 u'storage_policy INTEGER, request_key TEXT UNIQUE, time_stamp NOT ' | 76 u'storage_policy INTEGER, request_key TEXT UNIQUE, time_stamp NOT ' |
77 u'NULL DEFAULT CURRENT_TIMESTAMP, partition TEXT)', | 77 u'NULL DEFAULT CURRENT_TIMESTAMP, partition TEXT)'), |
78 u'cfurl_cache_schema_version': | 78 u'cfurl_cache_schema_version': ( |
79 u'CREATE TABLE cfurl_cache_schema_version(schema_version INTEGER)'}] | 79 u'CREATE TABLE cfurl_cache_schema_version(schema_version INTEGER)')}] |
80 | 80 |
81 def _DictToListOfStrings(self, data_dict): | 81 def _DictToListOfStrings(self, data_dict): |
82 """Converts a dictionary into a list of strings. | 82 """Converts a dictionary into a list of strings. |
83 | 83 |
84 Args: | 84 Args: |
85 data_dict (dict[str, object]): dictionary to convert. | 85 data_dict (dict[str, object]): dictionary to convert. |
86 | 86 |
87 Returns: | 87 Returns: |
88 list[str]: list of strings. | 88 list[str]: list of strings. |
89 """ | 89 """ |
(...skipping 168 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
258 u'Unable to parse time string: {0:s}'.format(time_value)) | 258 u'Unable to parse time string: {0:s}'.format(time_value)) |
259 return | 259 return |
260 | 260 |
261 event = time_events.TimestampEvent( | 261 event = time_events.TimestampEvent( |
262 timestamp, eventdata.EventTimestamp.ADDED_TIME) | 262 timestamp, eventdata.EventTimestamp.ADDED_TIME) |
263 | 263 |
264 parser_mediator.ProduceEventWithEventData(event, event_data) | 264 parser_mediator.ProduceEventWithEventData(event, event_data) |
265 | 265 |
266 | 266 |
267 sqlite.SQLiteParser.RegisterPlugin(MacKeeperCachePlugin) | 267 sqlite.SQLiteParser.RegisterPlugin(MacKeeperCachePlugin) |
LEFT | RIGHT |