:py:mod:`dissect.target.plugins.os.windows.log.pfro`
====================================================

.. py:module:: dissect.target.plugins.os.windows.log.pfro


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.log.pfro.PfroPlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.log.pfro.PfroRecord


.. py:data:: PfroRecord

   

.. py:class:: PfroPlugin(target)


   Bases: :py:obj:`dissect.target.plugin.Plugin`

   PFRO plugin.

   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with
      the current target (``self.target``). For example, check if a certain
      file exists.
      Otherwise it should raise an ``UnsupportedPluginError``.

      :raises UnsupportedPluginError: If the plugin could not be loaded.


   .. py:method:: pfro()

      Return the content of sysvol/Windows/PFRO.log

      A Pending File Rename Operation log file (PFRO.log) holds information about the process of deleting or renaming
      files that are locked or being used and that will be renamed on reboot. This is related to the filerenameop
      plugin.

      .. rubric:: References

      - https://social.technet.microsoft.com/Forums/en-US/9b66a7b0-16d5-4d22-be4e-51df12db9f80/issue-understanding-pfro-log
      - https://community.ccleaner.com/topic/49106-pending-file-rename-operations-log/

      Yields PfroRecords with fields:
          hostname (string): The target hostname.
          domain (string): The target domain.
          ts (datetime): The parsed timestamp.
          path (uri): The parsed path.
          operation (string): The parsed operation.