dissect.database.ese.record

Module Contents

Classes

Record	Wrapper class for records in a table.
RecordData	Record class for parsing and interacting with the on-disk record format.
TagField	Represents a TAGFLD, which contains information about a tagged field in a record.

Functions

noop
serialise_record_column_values

dissect.database.ese.record.noop(value: Any) → Any

class dissect.database.ese.record.Record(table: dissect.database.ese.table.Table, node: dissect.database.ese.page.Node)

Wrapper class for records in a table.

The actual parsing of the data is done in RecordData, but this class allows you to easily retrieve all the values by either using the .get() method, accessing them as attributes or dictionary keys on this class.

Parameters:

• table – The table this record is from.

• node – The node of this record.

__str__() → str

__repr__() → str

__hash__() → int

__getitem__(attr: str) → dissect.database.ese.util.RecordValue

__getattr__(attr: str) → dissect.database.ese.util.RecordValue

__eq__(value: object) → bool

__ne__(value: object) → bool

__lt__(value: object) → bool

__le__(value: object) → bool

__gt__(value: object) → bool

__ge__(value: object) → bool

get(attr: str, raw: bool = False) → dissect.database.ese.util.RecordValue

Retrieve a value from the record with the given name.

Optionally receive the raw data as it’s stored in the record.

Parameters:

• attr – The column name to retrieve the value of.

• raw – Whether to return the raw data stored in the record instead of the parsed value.

as_dict(raw: bool = False) → dict[str, dissect.database.ese.util.RecordValue]

class dissect.database.ese.record.RecordData(table: dissect.database.ese.table.Table, node: dissect.database.ese.page.Node)

Record class for parsing and interacting with the on-disk record format.

Templated columns are currently not implemented.

Parameters:

• table – The table this record is from.

• data – The node data of this record.

Raises:

NotImplementedError – If old format tagged fields are encountered.

table

db

node

data

header = None

get(column: dissect.database.ese.table.Column, raw: bool = False, errors: str | None = 'backslashreplace') → dissect.database.ese.util.RecordValue

Retrieve the value for the specified column.

Optionally receive the raw data as it’s stored in the record.

If the database has been opened in impacket compatibility mode, skip most of the parsing and return the values that impacket expects.

Parameters:

• column – The column to retrieve the value of.

• raw – Whether to return the raw data stored in the record instead of the parsed value.

• errors – Error handling scheme to use when decoding bytes to text (default: ‘backslashreplace’).

as_dict(raw: bool = False, errors: str | None = 'backslashreplace') → dict[str, dissect.database.ese.util.RecordValue]

Serialize the record as a dictionary.

class dissect.database.ese.record.TagField(record: RecordData, value: int)

Represents a TAGFLD, which contains information about a tagged field in a record.

__slots__ = ('_offset', 'flags', 'has_extended_info', 'identifier', 'offset', 'record')

fNullSmallPage = 8192

fDerived = 32768

record

identifier

__repr__() → str

property is_null: bool

Return whether this tagged field is null.

property is_derived: bool

Return whether this tagged field is derived.

dissect.database.ese.record.serialise_record_column_values(record: Record, column_names: list[str] | None = None, max_columns: int = 10) → str