acstore package

Subpackages

Submodules

acstore.fake_store module

Fake (in-memory only) attribute container store for testing.

class acstore.fake_store.FakeAttributeContainerIdentifier(sequence_number)[source]

Bases: AttributeContainerIdentifier

Fake attribute container identifier.

sequence_number

sequence number of the attribute container.

Type

int

CopyToString()[source]

Copies the identifier to a string representation.

Returns

unique identifier or None.

Return type

str

class acstore.fake_store.FakeAttributeContainerStore[source]

Bases: AttributeContainerStore

Fake (in-memory only) attribute container store.

Close()[source]

Closes the store.

Raises
  • IOError – if the store is already closed.

  • OSError – if the store is already closed.

GetAttributeContainerByIdentifier(container_type, identifier)[source]

Retrieves a specific type of container with a specific identifier.

Parameters
Returns

attribute container or None if not available.

Return type

AttributeContainer

GetAttributeContainerByIndex(container_type, index)[source]

Retrieves a specific attribute container.

Parameters
  • container_type (str) – attribute container type.

  • index (int) – attribute container index.

Returns

attribute container or None if not available.

Return type

AttributeContainer

GetAttributeContainers(container_type, filter_expression=None)[source]

Retrieves a specific type of attribute containers.

Parameters
  • container_type (str) – attribute container type.

  • filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.

Yields

AttributeContainer – attribute container.

GetNumberOfAttributeContainers(container_type)[source]

Retrieves the number of a specific type of attribute containers.

Parameters

container_type (str) – attribute container type.

Returns

the number of containers of a specified type.

Return type

int

HasAttributeContainers(container_type)[source]

Determines if a store contains a specific type of attribute container.

Parameters

container_type (str) – attribute container type.

Returns

True if the store contains the specified type of attribute

containers.

Return type

bool

Open(**kwargs)[source]

Opens the store.

Raises
  • IOError – if the store is already opened.

  • OSError – if the store is already opened.

acstore.interface module

The attribute container store interface.

class acstore.interface.AttributeContainerStore[source]

Bases: object

Interface of an attribute container store.

format_version

storage format version.

Type

int

serialization_format

serialization format.

Type

str

AddAttributeContainer(container)[source]

Adds a new attribute container.

Parameters

container (AttributeContainer) – attribute container.

Raises
  • OSError – if the store cannot be written to.

  • IOError – if the store cannot be written to.

abstract Close()[source]

Closes the store.

abstract GetAttributeContainerByIdentifier(container_type, identifier)[source]

Retrieves a specific type of container with a specific identifier.

Parameters
Returns

attribute container or None if not available.

Return type

AttributeContainer

Raises
  • IOError – when the store is closed or if an unsupported identifier is provided.

  • OSError – when the store is closed or if an unsupported identifier is provided.

abstract GetAttributeContainerByIndex(container_type, index)[source]

Retrieves a specific attribute container.

Parameters
  • container_type (str) – attribute container type.

  • index (int) – attribute container index.

Returns

attribute container or None if not available.

Return type

AttributeContainer

Raises
  • IOError – when the store is closed.

  • OSError – when the store is closed.

abstract GetAttributeContainers(container_type, filter_expression=None)[source]

Retrieves a specific type of attribute containers.

Parameters
  • container_type (str) – attribute container type.

  • filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.

Returns

attribute container generator.

Return type

generator(AttributeContainer)

Raises
  • IOError – when the store is closed.

  • OSError – when the store is closed.

abstract GetNumberOfAttributeContainers(container_type)[source]

Retrieves the number of a specific type of attribute containers.

Parameters

container_type (str) – attribute container type.

Returns

the number of containers of a specified type.

Return type

int

abstract HasAttributeContainers(container_type)[source]

Determines if a store contains a specific type of attribute container.

Parameters

container_type (str) – attribute container type.

Returns

True if the store contains the specified type of attribute

containers.

Return type

bool

abstract Open(**kwargs)[source]

Opens the store.

SetStorageProfiler(storage_profiler)[source]

Sets the storage profiler.

Parameters

storage_profiler (StorageProfiler) – storage profiler.

UpdateAttributeContainer(container)[source]

Updates an existing attribute container.

Parameters

container (AttributeContainer) – attribute container.

Raises
  • OSError – if the store cannot be written to.

  • IOError – if the store cannot be written to.

Module contents

Attribute Container Storage (ACStore).

ACStore, or Attribute Container Storage, provides a stand-alone implementation to read and write plaso storage files.