Evtx.Evtx.Evtx

Package Evtx :: Module Evtx :: Class Evtx |
[hide private]
[frames] | no frames]

# Class Evtx

source code

    A convenience class that makes it easy to open an
      EVTX file and start iterating the important structures.
    Note, this class must be used in a context statement
       (see the `with` keyword).
    Note, this class will mmap the target file, so ensure
      your platform supports this operation.

Instance Methods | [hide private]
__init__(self, filename) x.__init__(...) initializes x; see x.__class__.__doc__ for signature | source code
__enter__(self) | source code
__exit__(self, type, value, traceback) | source code
ensure_contexted(func) This decorator ensure that an instance of the Evtx class is used within a context statement. | source code
chunks(self, *args, **kwargs) Get each of the ChunkHeaders from within this EVTX file. | source code
records(self, *args, **kwargs) Get each of the Records from within this EVTX file. | source code
get_record(self, *args, **kwargs) Get a Record by record number. | source code
get_file_header(self, *args, **kwargs) | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, filename) (Constructor) | source code
x.__init__(...) initializes x; see x.__class__.__doc__ for signature Parameters: `filename` (str) - A string that contains the path to the EVTX file to open. Overrides: object.__init__

### ensure_contexted(func) | source code
    This decorator ensure that an instance of the
      Evtx class is used within a context statement.  That is,
      that the `with` statement is used, or `__enter__()`
      and `__exit__()` are called explicitly.

### chunks(self, *args, **kwargs) | source code
Get each of the ChunkHeaders from within this EVTX file. @rtype generator of ChunkHeader @return A generator of ChunkHeaders from this EVTX file. Decorators: `@ensure_contexted`

### records(self, *args, **kwargs) | source code
Get each of the Records from within this EVTX file. @rtype generator of Record @return A generator of Records from this EVTX file. Decorators: `@ensure_contexted`

### get_record(self, *args, **kwargs) | source code
    Get a Record by record number.

    @type record_num:  int
    @param record_num: The record number of the the record to fetch.
    @rtype Record or None
    @return The record request by record number, or None if
      the record is not found.
Decorators: `@ensure_contexted`

### get_file_header(self, *args, **kwargs) | source code
Decorators: `@ensure_contexted`