dissect.database.ese.cursor

Module Contents

Classes

Cursor

A simple cursor implementation for searching the ESE indexes.
class dissect.database.ese.cursor.Cursor(index: dissect.database.ese.index.Index)

A simple cursor implementation for searching the ESE indexes.

Parameters:

index – The Index to create the cursor for.

index
table
db
__iter__() → collections.abc.Iterator[dissect.database.ese.record.Record]
reset() → None

Reset the internal state.

search(**kwargs: dissect.database.ese.util.RecordValue) → dissect.database.ese.record.Record

Search the index for the requested values.

Searching modifies the cursor state. Searching again will search from the current position. Reset the cursor with reset() to start from the beginning.

Parameters:

**kwargs – The columns and values to search for.

Returns:

A Record object of the found record.

search_key(key: bytes, exact: bool = True) → dissect.database.ese.record.Record

Search for a record with the given key.

Parameters:

  • key – The key to search for.

  • exact – If True, search for an exact match. If False, sets the cursor on the next record that is greater than or equal to the key.

seek(**kwargs: dissect.database.ese.util.RecordValue) → None

Seek to the record with the given values.

Parameters:

**kwargs – The columns and values to seek to.

seek_key(key: bytes) → None

Seek to the record with the given key.

Parameters:

key – The key to seek to.

find(**kwargs: dissect.database.ese.util.RecordValue) → dissect.database.ese.record.Record | None

Find a record in the index.

This differs from search() in that it will allow additional filtering on non-indexed columns.

Parameters:

**kwargs – The columns and values to search for.

find_all(**kwargs: dissect.database.ese.util.RecordValue) → collections.abc.Iterator[dissect.database.ese.record.Record]

Find all records in the index that match the given values.

This differs from search() in that it will allows additional filtering on non-indexed columns. If you only search on indexed columns, this will yield all records that match the indexed columns.

Parameters:

**kwargs – The columns and values to search for.

record() → dissect.database.ese.record.Record

Return the record the cursor is currently on.

Returns:

A Record object of the current record.

next() → dissect.database.ese.record.Record

Move the cursor to the next record and return it.

Can move the cursor to the next page as a side effect.

Returns:

A Record object of the next record.

prev() → dissect.database.ese.record.Record

Move the cursor to the previous node and return it.

Can move the cursor to the previous page as a side effect.

Returns:

A Record object of the previous record.