Evtx.Views

Package Evtx :: Module Views |
[hide private]
[frames] | no frames]

# Module Views

source code

Classes | [hide private]
| UnexpectedElementException

Functions | [hide private]
_make_template_xml_view(root_node, cache=None) Given a RootNode, parse only the template/children and not the substitutions. | source code
_build_record_xml(record, cache=None) Note, the cache should be local to the Evtx.Chunk. | source code
evtx_record_xml_view(record, cache=None) Generate an UTF-8 XML representation of an EVTX record. | source code
generator of str, Evtx.Record |
evtx_chunk_xml_view(chunk) Generate UTF-8 XML representations of the records in an EVTX chunk. | source code
generator of str, Evtx.Record |
evtx_file_xml_view(file_header) Generate UTF-8 XML representations of the records in an EVTX file. | source code
evtx_template_readable_view(template_node) | source code

Variables | [hide private]
| __package__ = ``'``Evtx``'``

Function Details | [hide private]

### _make_template_xml_view(root_node, cache=None) | source code
    Given a RootNode, parse only the template/children
      and not the substitutions.

    Note, the cache should be local to the Evtx.Chunk.
      Do not share caches across Chunks.

    @type root_node: Nodes.RootNode
    @type cache: dict of {int: TemplateNode}
    @rtype: str

### _build_record_xml(record, cache=None) | source code
    Note, the cache should be local to the Evtx.Chunk.
      Do not share caches across Chunks.

    @type record: Evtx.Record
    @type cache: dict of {int: TemplateNode}
    @rtype: str

### evtx_record_xml_view(record, cache=None) | source code
    Generate an UTF-8 XML representation of an EVTX record.

    Note, the cache should be local to the Evtx.Chunk.
      Do not share caches across Chunks.

    @type record: Evtx.Record
    @type cache: dict of {int: TemplateNode}
    @rtype: str

### evtx_chunk_xml_view(chunk) | source code
Generate UTF-8 XML representations of the records in an EVTX chunk. Does not include the XML <?xml... header. Records are ordered by chunk.records() Parameters: `chunk` (Evtx.Chunk) Returns: generator of str, Evtx.Record

### evtx_file_xml_view(file_header) | source code
Generate UTF-8 XML representations of the records in an EVTX file. Does not include the XML <?xml... header. Records are ordered by file_header.chunks(), and then by chunk.records() Parameters: `file_header` (Evtx.FileHeader) Returns: generator of str, Evtx.Record