dissect.etl.etl

Module Contents

Classes

ETL	The main interface when controlling an ETL file.
Buffer
EventRecord
Event

Functions

parse_payload

Parse the event payload using the appropriate manifest, if available.

Attributes

c_etl

dissect.etl.etl.c_etl

class dissect.etl.etl.ETL(fh)

The main interface when controlling an ETL file.

buffer(index: int) → Buffer

Reads a specific buffer into memory.

buffers() → Iterable[Buffer]

__iter__() → Iterable[Event]

calculate_timestamp(time_delta: int) → datetime.datetime

get_filetime_for_event(time_delta: int) → int

class dissect.etl.etl.Buffer(etl, offset)

property header

property size: int

property data: memoryview

property data_offset: int

property filled_bytes: int

property next_buffer: int

__iter__() → Iterable[EventRecord]

read_record(offset)

Parse a record from a given offset inside a buffer.

open()

class dissect.etl.etl.EventRecord

property header: dissect.etl.headers.headers.Header

A header of the type Header

property size: int

Size of the whole record.

property event: Event

Parse payload inside the event header.

property aligned_size

__slots__ = ('_header', '_event')

__repr__()

Return repr(self).

class dissect.etl.etl.Event(header: dissect.etl.headers.headers.Header, event_manifest)

__slots__ = ['_record', '_manifest', '_struct', '_event', '_header']

__getattr__(attribute: str)

provider_name() → str | None

Returns the manifest provider name.

ts() → datetime.datetime

Returns the event timestamp.

provider_id() → uuid.UUID

Returns the GUID of the provider from the header.

symbol()

event_values() → dict[str, Any]

Create an items view that holds event and header data.

The header data is additional information provided from a specific header. The event data is from a specific manifest file if it exists.

__repr__()

Return repr(self).

dissect.etl.etl.parse_payload(header: dissect.etl.headers.headers.Header)

Parse the event payload using the appropriate manifest, if available.