Package Evtx :: Module Views
[hide private]
[frames] | no frames]

Module Views

source code

Classes [hide private]
  UnexpectedElementException
Functions [hide private]
 
_make_template_xml_view(root_node, cache=None)
Given a RootNode, parse only the template/children and not the substitutions.
source code
 
_build_record_xml(record, cache=None)
Note, the cache should be local to the Evtx.Chunk.
source code
 
evtx_record_xml_view(record, cache=None)
Generate an UTF-8 XML representation of an EVTX record.
source code
generator of str, Evtx.Record
evtx_chunk_xml_view(chunk)
Generate UTF-8 XML representations of the records in an EVTX chunk.
source code
generator of str, Evtx.Record
evtx_file_xml_view(file_header)
Generate UTF-8 XML representations of the records in an EVTX file.
source code
 
evtx_template_readable_view(template_node) source code
Variables [hide private]
  __package__ = 'Evtx'
Function Details [hide private]

_make_template_xml_view(root_node, cache=None)

source code 

Given a RootNode, parse only the template/children
  and not the substitutions.

Note, the cache should be local to the Evtx.Chunk.
  Do not share caches across Chunks.

@type root_node: Nodes.RootNode
@type cache: dict of {int: TemplateNode}
@rtype: str

_build_record_xml(record, cache=None)

source code 

Note, the cache should be local to the Evtx.Chunk.
  Do not share caches across Chunks.

@type record: Evtx.Record
@type cache: dict of {int: TemplateNode}
@rtype: str

evtx_record_xml_view(record, cache=None)

source code 

Generate an UTF-8 XML representation of an EVTX record.

Note, the cache should be local to the Evtx.Chunk.
  Do not share caches across Chunks.

@type record: Evtx.Record
@type cache: dict of {int: TemplateNode}
@rtype: str

evtx_chunk_xml_view(chunk)

source code 

Generate UTF-8 XML representations of the records in an EVTX chunk.

Does not include the XML <?xml... header. Records are ordered by chunk.records()

Parameters:
  • chunk (Evtx.Chunk)
Returns: generator of str, Evtx.Record

evtx_file_xml_view(file_header)

source code 

Generate UTF-8 XML representations of the records in an EVTX file.

Does not include the XML <?xml... header. Records are ordered by file_header.chunks(), and then by chunk.records()

Parameters:
  • file_header (Evtx.FileHeader)
Returns: generator of str, Evtx.Record