dissect.target.plugins.os.windows.regf.recentfilecache
#
Module Contents#
Classes#
Plugin that parses the RecentFileCache.bcf file. |
Attributes#
- dissect.target.plugins.os.windows.regf.recentfilecache.c_recent_files_def = Multiline-String#
Show Value
""" struct header { uint32 magic; uint32 unk0; uint32 unk1; uint32 unk2; uint32 checksum; }; struct entry { uint32 length; wchar path[length + 1]; }; """
- dissect.target.plugins.os.windows.regf.recentfilecache.c_recent_files#
- dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCacheRecord#
- class dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCachePlugin(target)#
Bases:
dissect.target.plugin.Plugin
Plugin that parses the RecentFileCache.bcf file.
- check_compatible()#
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- recentfilecache()#
Parse RecentFileCache.bcf.
- Yields RecentFileCacheRecords with fields:
hostname (string): The target hostname. domain (string): The target domain. path (uri): The parsed path.