Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code | Sign in
(510)

Issue 327070043: [plaso] Add amcache parser #740 (Closed)

Can't Edit
Can't Publish+Mail
Start Review
Created:
2 months, 1 week ago by rbdebeer
Modified:
1 month, 3 weeks ago
Reviewers:
jberggren, onager
CC:
Joachim Metz, romaing, kiddi, log2timeline-dev_googlegroups.com, aaronp
Visibility:
Public.

Description

[plaso] Add amcache parser #740

Patch Set 1 #

Total comments: 26

Patch Set 2 : Process codereview comments and fix bugs #

Total comments: 9

Patch Set 3 : Process codereview comments #

Total comments: 12

Patch Set 4 : Process more codereview comments. #

Unified diffs Side-by-side diffs Delta from patch set Stats (+448 lines, -0 lines) Patch
M plaso/formatters/__init__.py View 1 chunk +1 line, -0 lines 0 comments Download
A plaso/formatters/amcache.py View 1 2 1 chunk +57 lines, -0 lines 0 comments Download
M plaso/parsers/__init__.py View 1 chunk +1 line, -0 lines 0 comments Download
A plaso/parsers/amcache.py View 1 2 3 1 chunk +331 lines, -0 lines 0 comments Download
M plaso/parsers/presets.py View 1 chunk +2 lines, -1 line 0 comments Download
A test_data/Amcache.hve View 0 chunks +-1 lines, --1 lines 0 comments Download
A tests/parsers/amcache.py View 1 1 chunk +57 lines, -0 lines 0 comments Download

Messages

Total messages: 14
rbdebeer
2 months, 1 week ago (2017-08-09 09:56:41 UTC) #1
onager
https://codereview.appspot.com/327070043/diff/1/plaso/parsers/amcache.py File plaso/parsers/amcache.py (right): https://codereview.appspot.com/327070043/diff/1/plaso/parsers/amcache.py#newcode3 plaso/parsers/amcache.py:3: add "from __future__ import unicode_literals" and drop all 'u' ...
2 months, 1 week ago (2017-08-09 10:38:17 UTC) #2
rbdebeer
Code updated.
2 months ago (2017-08-22 11:24:33 UTC) #3
rbdebeer
Comments processed, Root/File key information extended and Root/Program key functionality added. https://codereview.appspot.com/327070043/diff/1/plaso/parsers/amcache.py File plaso/parsers/amcache.py (right): ...
2 months ago (2017-08-22 11:26:00 UTC) #4
onager
https://codereview.appspot.com/327070043/diff/20001/plaso/formatters/amcache.py File plaso/formatters/amcache.py (right): https://codereview.appspot.com/327070043/diff/20001/plaso/formatters/amcache.py#newcode33 plaso/formatters/amcache.py:33: """Formatter for an Amcache greePrograms Windows Registry event.""" Typo? ...
1 month, 4 weeks ago (2017-08-22 13:13:42 UTC) #5
rbdebeer
https://codereview.appspot.com/327070043/diff/20001/plaso/formatters/amcache.py File plaso/formatters/amcache.py (right): https://codereview.appspot.com/327070043/diff/20001/plaso/formatters/amcache.py#newcode33 plaso/formatters/amcache.py:33: """Formatter for an Amcache greePrograms Windows Registry event.""" On ...
1 month, 4 weeks ago (2017-08-23 12:25:47 UTC) #6
onager
https://codereview.appspot.com/327070043/diff/20001/plaso/parsers/amcache.py File plaso/parsers/amcache.py (right): https://codereview.appspot.com/327070043/diff/20001/plaso/parsers/amcache.py#newcode170 plaso/parsers/amcache.py:170: if am_entry.get_value_by_name(self._AMCACHE_PRODUCTNAME) is not None: On 2017/08/23 12:25:47, rbdebeer ...
1 month, 4 weeks ago (2017-08-23 12:32:26 UTC) #7
rbdebeer
Code updated.
1 month, 4 weeks ago (2017-08-23 17:31:03 UTC) #8
rbdebeer
https://codereview.appspot.com/327070043/diff/20001/plaso/parsers/amcache.py File plaso/parsers/amcache.py (right): https://codereview.appspot.com/327070043/diff/20001/plaso/parsers/amcache.py#newcode162 plaso/parsers/amcache.py:162: amcache_datetime = am_entry.get_value_by_name( On 2017/08/22 13:13:41, onager wrote: > ...
1 month, 4 weeks ago (2017-08-23 17:31:46 UTC) #9
onager
https://codereview.appspot.com/327070043/diff/40001/plaso/parsers/amcache.py File plaso/parsers/amcache.py (right): https://codereview.appspot.com/327070043/diff/40001/plaso/parsers/amcache.py#newcode175 plaso/parsers/amcache.py:175: def _ProcessAMCacheProgramKey(self, am_entry, parser_mediator): +docstring https://codereview.appspot.com/327070043/diff/40001/plaso/parsers/amcache.py#newcode178 plaso/parsers/amcache.py:178: pevent_data = ...
1 month, 4 weeks ago (2017-08-24 10:41:31 UTC) #10
rbdebeer
Code updated.
1 month, 4 weeks ago (2017-08-24 11:49:48 UTC) #11
rbdebeer
https://codereview.appspot.com/327070043/diff/40001/plaso/parsers/amcache.py File plaso/parsers/amcache.py (right): https://codereview.appspot.com/327070043/diff/40001/plaso/parsers/amcache.py#newcode175 plaso/parsers/amcache.py:175: def _ProcessAMCacheProgramKey(self, am_entry, parser_mediator): On 2017/08/24 10:41:31, onager wrote: ...
1 month, 4 weeks ago (2017-08-24 11:50:49 UTC) #12
onager
LGTM, merging
1 month, 3 weeks ago (2017-08-24 14:43:20 UTC) #13
onager
1 month, 3 weeks ago (2017-08-24 14:47:13 UTC) #14
Changes have been merged with master branch. To close the review and clean up
the feature branch you can run: python ./utils/review.py close plugin-amcache
Sign in to reply to this message.

Powered by Google App Engine
RSS Feeds Recent Issues | This issue
This is Rietveld 80a51fa-tainted