|
|
|
|
|
|
|
check_magic(self)
@return A boolean that indicates if the first eight bytes of
the FileHeader match the expected magic value. |
source code
|
|
|
calculate_checksum(self)
@return A integer in the range of an unsigned int that
is the calculated CRC32 checksum off the first 0x78 bytes. |
source code
|
|
|
verify(self)
@return A boolean that indicates that the FileHeader
successfully passes a set of heuristic checks that
all EVTX FileHeaders should pass. |
source code
|
|
|
is_dirty(self)
@return A boolean that indicates that the log has been
opened and was changed, though not all changes might be
reflected in the file header. |
source code
|
|
|
is_full(self)
@return A boolean that indicates that the log
has reached its maximum configured size and the retention
policy in effect does not allow to reclaim a suitable amount
of space from the oldest records and an event message could
not be written to the log file. |
source code
|
|
|
first_chunk(self)
@return A ChunkHeader instance that is the first chunk
in the log file, which is always found directly after
the FileHeader. |
source code
|
|
|
current_chunk(self)
@return A ChunkHeader instance that is the current chunk
indicated by the FileHeader. |
source code
|
|
|
chunks(self)
@return A generator that yields the chunks of the log file
starting with the first chunk, which is always found directly
after the FileHeader, and continuing to the end of the file. |
source code
|
|
|
|
Inherited from BinaryParser.Block :
__unicode__ ,
absolute_offset ,
current_field_offset ,
declare_field ,
offset ,
pack_word ,
unpack_binary ,
unpack_byte ,
unpack_dosdate ,
unpack_double ,
unpack_dword ,
unpack_dword_be ,
unpack_filetime ,
unpack_float ,
unpack_guid ,
unpack_int16 ,
unpack_int32 ,
unpack_int64 ,
unpack_int8 ,
unpack_qword ,
unpack_string ,
unpack_systemtime ,
unpack_word ,
unpack_word_be ,
unpack_wstring
Inherited from object :
__delattr__ ,
__format__ ,
__getattribute__ ,
__hash__ ,
__new__ ,
__reduce__ ,
__reduce_ex__ ,
__setattr__ ,
__sizeof__ ,
__subclasshook__
|