Package Evtx :: Module Evtx :: Class Evtx
[hide private]
[frames] | no frames]

Class Evtx

source code



A convenience class that makes it easy to open an
  EVTX file and start iterating the important structures.
Note, this class must be used in a context statement
   (see the `with` keyword).
Note, this class will mmap the target file, so ensure
  your platform supports this operation.

Instance Methods [hide private]
 
__init__(self, filename)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature
source code
 
__enter__(self) source code
 
__exit__(self, type, value, traceback) source code
 
ensure_contexted(func)
This decorator ensure that an instance of the Evtx class is used within a context statement.
source code
 
chunks(self, *args, **kwargs)
Get each of the ChunkHeaders from within this EVTX file.
source code
 
records(self, *args, **kwargs)
Get each of the Records from within this EVTX file.
source code
 
get_record(self, *args, **kwargs)
Get a Record by record number.
source code
 
get_file_header(self, *args, **kwargs) source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, filename)
(Constructor)

source code 

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Parameters:
  • filename (str) - A string that contains the path to the EVTX file to open.
Overrides: object.__init__

ensure_contexted(func)

source code 

This decorator ensure that an instance of the
  Evtx class is used within a context statement.  That is,
  that the `with` statement is used, or `__enter__()`
  and `__exit__()` are called explicitly.

chunks(self, *args, **kwargs)

source code 

Get each of the ChunkHeaders from within this EVTX file.

@rtype generator of ChunkHeader @return A generator of ChunkHeaders from this EVTX file.

Decorators:
  • @ensure_contexted

records(self, *args, **kwargs)

source code 

Get each of the Records from within this EVTX file.

@rtype generator of Record @return A generator of Records from this EVTX file.

Decorators:
  • @ensure_contexted

get_record(self, *args, **kwargs)

source code 

Get a Record by record number.

@type record_num:  int
@param record_num: The record number of the the record to fetch.
@rtype Record or None
@return The record request by record number, or None if
  the record is not found.

Decorators:
  • @ensure_contexted

get_file_header(self, *args, **kwargs)

source code 
Decorators:
  • @ensure_contexted