Package Evtx :: Module Evtx :: Class FileHeader
[hide private]
[frames] | no frames]

Class FileHeader

source code


Instance Methods [hide private]
 
__init__(self, buf, offset)
Constructor.
source code
 
__repr__(self)
repr(x)
source code
 
__str__(self)
str(x)
source code
 
check_magic(self)
@return A boolean that indicates if the first eight bytes of the FileHeader match the expected magic value.
source code
 
calculate_checksum(self)
@return A integer in the range of an unsigned int that is the calculated CRC32 checksum off the first 0x78 bytes.
source code
 
verify(self)
@return A boolean that indicates that the FileHeader successfully passes a set of heuristic checks that all EVTX FileHeaders should pass.
source code
 
is_dirty(self)
@return A boolean that indicates that the log has been opened and was changed, though not all changes might be reflected in the file header.
source code
 
is_full(self)
@return A boolean that indicates that the log has reached its maximum configured size and the retention policy in effect does not allow to reclaim a suitable amount of space from the oldest records and an event message could not be written to the log file.
source code
 
first_chunk(self)
@return A ChunkHeader instance that is the first chunk in the log file, which is always found directly after the FileHeader.
source code
 
current_chunk(self)
@return A ChunkHeader instance that is the current chunk indicated by the FileHeader.
source code
 
chunks(self)
@return A generator that yields the chunks of the log file starting with the first chunk, which is always found directly after the FileHeader, and continuing to the end of the file.
source code
 
get_record(self, record_num)
Get a Record by record number.
source code

Inherited from BinaryParser.Block: __unicode__, absolute_offset, current_field_offset, declare_field, offset, pack_word, unpack_binary, unpack_byte, unpack_dosdate, unpack_double, unpack_dword, unpack_dword_be, unpack_filetime, unpack_float, unpack_guid, unpack_int16, unpack_int32, unpack_int64, unpack_int8, unpack_qword, unpack_string, unpack_systemtime, unpack_word, unpack_word_be, unpack_wstring

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __setattr__, __sizeof__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, buf, offset)
(Constructor)

source code 

Constructor.
Arguments:
- `buf`: Byte string containing stuff to parse.
- `offset`: The offset into the buffer at which the block starts.

Overrides: object.__init__
(inherited documentation)

__repr__(self)
(Representation operator)

source code 

repr(x)

Overrides: object.__repr__
(inherited documentation)

__str__(self)
(Informal representation operator)

source code 

str(x)

Overrides: object.__str__
(inherited documentation)

calculate_checksum(self)

source code 

@return A integer in the range of an unsigned int that
  is the calculated CRC32 checksum off the first 0x78 bytes.
  This is consistent with the checksum stored by the FileHeader.

get_record(self, record_num)

source code 

Get a Record by record number.

@type record_num:  int
@param record_num: The record number of the the record to fetch.
@rtype Record or None
@return The record request by record number, or None if the
  record is not found.