dissect.target.plugins.os.unix.linux.recentlyused

Module Contents

Classes

RecentlyUsedPlugin

Parse recently-used.xbel files on Gnome-based Linux Desktops.

Functions

parse_ts	Parse timestamp format from xbel file
parse_recently_used_xbel

Attributes

RecentlyUsedRecord
RecentlyUsedIconRecord
RecentlyUsedApplicationRecord
ns

dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedRecord

dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedIconRecord

dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedApplicationRecord

dissect.target.plugins.os.unix.linux.recentlyused.ns

dissect.target.plugins.os.unix.linux.recentlyused.parse_ts(target: dissect.target.Target, ts: str) → datetime.datetime | None

Parse timestamp format from xbel file

Returns None if unable to parse the timestamp

dissect.target.plugins.os.unix.linux.recentlyused.parse_recently_used_xbel(target: dissect.target.Target, username: str, xbel_file: dissect.target.helpers.fsutil.TargetPath) → collections.abc.Iterator[RecentlyUsedRecord | flow.record.GroupedRecord] | None

class dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin(target: dissect.target.Target)

Bases: dissect.target.plugin.Plugin

Parse recently-used.xbel files on Gnome-based Linux Desktops.

Based on the spec on https://www.freedesktop.org/wiki/Specifications/desktop-bookmark-spec/

FILEPATH = '.local/share/recently-used.xbel'

users_files: list[tuple[str, dissect.target.helpers.fsutil.TargetPath]] = []

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

recently_used() → collections.abc.Iterator[RecentlyUsedRecord | flow.record.GroupedRecord]

Parse recently-used.xbel files on Linux Desktops.