dissect.target.plugins.browsers.iexplore#

Module Contents#

Classes#

WebCache

InternetExplorerPlugin

Internet explorer browser plugin.

Attributes#

dissect.target.plugins.browsers.iexplore.IEBrowserHistoryRecord#
class dissect.target.plugins.browsers.iexplore.WebCache(target: dissect.target.target.Target, fh: BinaryIO)#
find_containers(name: str) dissect.esedb.table.Table#
history() Iterator[dissect.esedb.record.Record]#
class dissect.target.plugins.browsers.iexplore.InternetExplorerPlugin(target: dissect.target.target.Target)#

Bases: dissect.target.plugin.Plugin

Internet explorer browser plugin.

__namespace__ = 'iexplore'#
DIRS = ['AppData/Local/Microsoft/Windows/WebCache']#
CACHE_FILENAME = 'WebCacheV01.dat'#
check_compatible() bool#

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

history() Iterator[IEBrowserHistoryRecord]#

Return browser history records from Internet Explorer.

Yields IEBrowserHistoryRecord with the following fields:

hostname (string): The target hostname. domain (string): The target domain. ts (datetime): Visit timestamp. browser (string): The browser from which the records are generated from. id (string): Record ID. url (uri): History URL. title (string): Page title. description (string): Page description. rev_host (string): Reverse hostname. visit_type (varint): Visit type. visit_count (varint): Amount of visits. hidden (string): Hidden value. typed (string): Typed value. session (varint): Session value. from_visit (varint): Record ID of the “from” visit. from_url (uri): URL of the “from” visit. source: (path): The source file of the history record.