dissect.target.plugins.os.windows.thumbcache

Module Contents

Classes

ThumbcachePlugin

Windows thumbcache plugin.

Attributes

GENERIC_THUMBCACHE_FIELDS
IndexRecord
ThumbcacheRecord
IconcacheRecord

dissect.target.plugins.os.windows.thumbcache.GENERIC_THUMBCACHE_FIELDS = [('string', 'identifier'), ('string', 'hash'), ('string', 'extension'), ('varint', 'data_size'),...

dissect.target.plugins.os.windows.thumbcache.IndexRecord

dissect.target.plugins.os.windows.thumbcache.ThumbcacheRecord

dissect.target.plugins.os.windows.thumbcache.IconcacheRecord

class dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.Plugin

Windows thumbcache plugin.

__namespace__ = 'thumbcache'

Defines the plugin namespace.

get_cache_paths() → collections.abc.Iterator[dissect.target.helpers.fsutil.TargetPath]

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

thumbcache(output_dir: pathlib.Path | None = None) → collections.abc.Iterator[ThumbcacheRecord | IndexRecord]

Yield thumbcache thumbnails.

iconcache(output_dir: pathlib.Path | None = None) → collections.abc.Iterator[IconcacheRecord | IndexRecord]

Yield iconcache thumbnails.