:py:mod:`dissect.target.plugins.os.windows.regf.recentfilecache`
================================================================

.. py:module:: dissect.target.plugins.os.windows.regf.recentfilecache


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCachePlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.regf.recentfilecache.c_recent_files_def
   dissect.target.plugins.os.windows.regf.recentfilecache.c_recent_files
   dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCacheRecord


.. py:data:: c_recent_files_def
   :value: Multiline-String

    .. raw:: html

        <details><summary>Show Value</summary>

    .. code-block:: python

        """
            struct header {
                uint32  magic;
                uint32  unk0;
                uint32  unk1;
                uint32  unk2;
                uint32  checksum;
            };
        
            struct entry {
                uint32  length;
                wchar   path[length + 1];
            };
            """

    .. raw:: html

        </details>

   

.. py:data:: c_recent_files

   

.. py:data:: RecentFileCacheRecord

   

.. py:class:: RecentFileCachePlugin(target)


   Bases: :py:obj:`dissect.target.plugin.Plugin`

   Plugin that parses the RecentFileCache.bcf file.

   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with
      the current target (``self.target``). For example, check if a certain
      file exists.
      Otherwise it should raise an ``UnsupportedPluginError``.

      :raises UnsupportedPluginError: If the plugin could not be loaded.


   .. py:method:: recentfilecache()

      Parse RecentFileCache.bcf.

      Yields RecentFileCacheRecords with fields:
          hostname (string): The target hostname.
          domain (string): The target domain.
          path (uri): The parsed path.