Evtx.Evtx.FileHeader

Package Evtx :: Module Evtx :: Class FileHeader |
[hide private]
[frames] | no frames]

# Class FileHeader

source code

Instance Methods | [hide private]
__init__(self, buf, offset) Constructor. | source code
__repr__(self) repr(x) | source code
__str__(self) str(x) | source code
check_magic(self) @return A boolean that indicates if the first eight bytes of the FileHeader match the expected magic value. | source code
calculate_checksum(self) @return A integer in the range of an unsigned int that is the calculated CRC32 checksum off the first 0x78 bytes. | source code
verify(self) @return A boolean that indicates that the FileHeader successfully passes a set of heuristic checks that all EVTX FileHeaders should pass. | source code
is_dirty(self) @return A boolean that indicates that the log has been opened and was changed, though not all changes might be reflected in the file header. | source code
is_full(self) @return A boolean that indicates that the log has reached its maximum configured size and the retention policy in effect does not allow to reclaim a suitable amount of space from the oldest records and an event message could not be written to the log file. | source code
first_chunk(self) @return A ChunkHeader instance that is the first chunk in the log file, which is always found directly after the FileHeader. | source code
current_chunk(self) @return A ChunkHeader instance that is the current chunk indicated by the FileHeader. | source code
chunks(self) @return A generator that yields the chunks of the log file starting with the first chunk, which is always found directly after the FileHeader, and continuing to the end of the file. | source code
get_record(self, record_num) Get a Record by record number. | source code
Inherited from `BinaryParser.Block`: `__unicode__`, `absolute_offset`, `current_field_offset`, `declare_field`, `offset`, `pack_word`, `unpack_binary`, `unpack_byte`, `unpack_dosdate`, `unpack_double`, `unpack_dword`, `unpack_dword_be`, `unpack_filetime`, `unpack_float`, `unpack_guid`, `unpack_int16`, `unpack_int32`, `unpack_int64`, `unpack_int8`, `unpack_qword`, `unpack_string`, `unpack_systemtime`, `unpack_word`, `unpack_word_be`, `unpack_wstring` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__setattr__`, `__sizeof__`, `__subclasshook__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, buf, offset) (Constructor) | source code
    Constructor.
    Arguments:
    - `buf`: Byte string containing stuff to parse.
    - `offset`: The offset into the buffer at which the block starts.
Overrides: object.__init__ (inherited documentation)

### __repr__(self) (Representation operator) | source code
repr(x) Overrides: object.__repr__ (inherited documentation)

### __str__(self) (Informal representation operator) | source code
str(x) Overrides: object.__str__ (inherited documentation)

### calculate_checksum(self) | source code
    @return A integer in the range of an unsigned int that
      is the calculated CRC32 checksum off the first 0x78 bytes.
      This is consistent with the checksum stored by the FileHeader.

### get_record(self, record_num) | source code
    Get a Record by record number.

    @type record_num:  int
    @param record_num: The record number of the the record to fetch.
    @rtype Record or None
    @return The record request by record number, or None if the
      record is not found.