[plaso] Add database schema matching to sqlite plugins #1093

[plaso] Add database schema matching to sqlite plugins #1093

[Joachim Metz, 2016-11-24 16:03:55]

Some initial nits

https://codereview.appspot.com/319750043/diff/1/plaso/parsers/sqlite.py
File plaso/parsers/sqlite.py (right):

https://codereview.appspot.com/319750043/diff/1/plaso/parsers/sqlite.py#newco...
plaso/parsers/sqlite.py:116: @property
what is the advantage of this being a property? why not a make it a public
attribute?

https://codereview.appspot.com/319750043/diff/1/plaso/parsers/sqlite.py#newco...
plaso/parsers/sqlite.py:118: """dict[str, str]: table names mapped to creation
query"""
please add dot """ => ."""

https://codereview.appspot.com/319750043/diff/1/utils/schema_extractor.py
File utils/schema_extractor.py (right):

https://codereview.appspot.com/319750043/diff/1/utils/schema_extractor.py#new...
utils/schema_extractor.py:37: # Get database schema.
Move it to a function named GetDatabaseSchema() so it's clear from the code what
this is supposed to do ;)

https://codereview.appspot.com/319750043/diff/1/utils/schema_extractor.py#new...
utils/schema_extractor.py:73: 
- white lines

[dc3.plaso, 2016-12-01 15:25:40]

Code updated.

[dc3.plaso, 2016-12-01 15:25:45]

https://codereview.appspot.com/319750043/diff/1/plaso/parsers/sqlite.py
File plaso/parsers/sqlite.py (right):

https://codereview.appspot.com/319750043/diff/1/plaso/parsers/sqlite.py#newco...
plaso/parsers/sqlite.py:116: @property
On 2016/11/24 16:03:55, Joachim Metz wrote:
> what is the advantage of this being a property? why not a make it a public
> attribute?

You make a good point. I was just sticking with the style of table_names. I'll
switch it.

https://codereview.appspot.com/319750043/diff/1/plaso/parsers/sqlite.py#newco...
plaso/parsers/sqlite.py:118: """dict[str, str]: table names mapped to creation
query"""
On 2016/11/24 16:03:54, Joachim Metz wrote:
> please add dot """ => ."""

Acknowledged.

https://codereview.appspot.com/319750043/diff/1/utils/schema_extractor.py
File utils/schema_extractor.py (right):

https://codereview.appspot.com/319750043/diff/1/utils/schema_extractor.py#new...
utils/schema_extractor.py:37: # Get database schema.
On 2016/11/24 16:03:55, Joachim Metz wrote:
> Move it to a function named GetDatabaseSchema() so it's clear from the code
what
> this is supposed to do ;)

Acknowledged.

https://codereview.appspot.com/319750043/diff/1/utils/schema_extractor.py#new...
utils/schema_extractor.py:73: 
On 2016/11/24 16:03:55, Joachim Metz wrote:
> - white lines

Acknowledged.

[waxmigs2902, 2016-12-02 07:29:14]

Cheers still

[waxmigs2902, 2016-12-02 07:30:11]

Cheers

[Joachim Metz, 2016-12-31 11:05:14]

I like the idea of checking the schema but the schema_match approach does not
match the direction for the event object.
Also see: https://codereview.appspot.com/319930043/

I'll revisit this CL after the dfdatetime changes and merge the parts that can
be used.

[dc3.plaso, 2017-01-03 14:21:08]

On 2016/12/31 11:05:14, Joachim Metz wrote:
> I like the idea of checking the schema but the schema_match approach does not
> match the direction for the event object.
> Also see: https://codereview.appspot.com/319930043/
> 
> I'll revisit this CL after the dfdatetime changes and merge the parts that can
> be used.

That's understandable. Let me know if you would like me to rework a solutions
after your changes have been integrated.

[Joachim Metz, 2017-04-06 05:39:28]

Aiming to have a look merging this soon.

[Joachim Metz, 2017-04-06 05:39:29]

Aiming to have a look merging this soon.

[Joachim Metz, 2017-04-08 18:45:58]

Started migrating changes into https://codereview.appspot.com/316460043/