:py:mod:`dissect.target.plugins.os.windows.log.pfro`
====================================================

.. py:module:: dissect.target.plugins.os.windows.log.pfro




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.log.pfro.PfroPlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.log.pfro.PfroRecord


.. py:data:: PfroRecord

.. py:class:: PfroPlugin(target: dissect.target.target.Target)

   Bases: :py:obj:`dissect.target.plugin.Plugin`


   PFRO plugin.


   .. py:attribute:: logfile


   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with the current target (``self.target``).
      For example, check if a certain file exists. Otherwise it should raise an
      :class:`UnsupportedPluginError`.

      :raises UnsupportedPluginError: If the plugin could not be loaded.



   .. py:method:: pfro() -> collections.abc.Iterator[PfroRecord]

      Return the content of %windir%/PFRO.log

      A Pending File Rename Operation log file (PFRO.log) holds information about the process of deleting or renaming
      files that are locked or being used and that will be renamed on reboot. This is related to the filerenameop
      plugin.

      .. rubric:: References

      - https://social.technet.microsoft.com/Forums/en-US/9b66a7b0-16d5-4d22-be4e-51df12db9f80/issue-understanding-pfro-log
      - https://community.ccleaner.com/topic/49106-pending-file-rename-operations-log/

      Yields PfroRecords with fields:

      .. code-block:: text

          hostname (string): The target hostname.
          domain (string): The target domain.
          ts (datetime): The parsed timestamp.
          path (uri): The parsed path.
          operation (string): The parsed operation.