acstore package

Subpackages

Submodules

acstore.errors module

The error objects.

exception acstore.errors.Error[source]

Bases: Exception

The error interface.

exception acstore.errors.ParseError[source]

Bases: Error

Raised when a parse error occurred.

acstore.fake_store module

Fake (in-memory only) attribute container store for testing.

class acstore.fake_store.FakeAttributeContainerStore[source]

Bases: AttributeContainerStore

Fake (in-memory only) attribute container store.

Close()[source]

Closes the store.

Raises:
  • IOError – if the store is already closed.

  • OSError – if the store is already closed.

GetAttributeContainerByIdentifier(container_type, identifier)[source]

Retrieves a specific type of container with a specific identifier.

Parameters:
Returns:

attribute container or None if not available.

Return type:

AttributeContainer

GetAttributeContainerByIndex(container_type, index)[source]

Retrieves a specific attribute container.

Parameters:
  • container_type (str) – attribute container type.

  • index (int) – attribute container index.

Returns:

attribute container or None if not available.

Return type:

AttributeContainer

GetAttributeContainers(container_type, filter_expression=None)[source]

Retrieves a specific type of attribute containers.

Parameters:
  • container_type (str) – attribute container type.

  • filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.

Yields:

AttributeContainer – attribute container.

GetNumberOfAttributeContainers(container_type)[source]

Retrieves the number of a specific type of attribute containers.

Parameters:

container_type (str) – attribute container type.

Returns:

the number of containers of a specified type.

Return type:

int

HasAttributeContainers(container_type)[source]

Determines if a store contains a specific type of attribute container.

Parameters:

container_type (str) – attribute container type.

Returns:

True if the store contains the specified type of attribute

containers.

Return type:

bool

Open(**kwargs)[source]

Opens the store.

Raises:
  • IOError – if the store is already opened.

  • OSError – if the store is already opened.

__init__()[source]

Initializes a fake (in-memory only) store.

acstore.interface module

The attribute container store interface.

class acstore.interface.AttributeContainerStore[source]

Bases: object

Interface of an attribute container store.

format_version

storage format version.

Type:

int

AddAttributeContainer(container)[source]

Adds a new attribute container.

Parameters:

container (AttributeContainer) – attribute container.

Raises:
  • OSError – if the store cannot be written to.

  • IOError – if the store cannot be written to.

abstract Close()[source]

Closes the store.

abstract GetAttributeContainerByIdentifier(container_type, identifier)[source]

Retrieves a specific type of container with a specific identifier.

Parameters:
Returns:

attribute container or None if not available.

Return type:

AttributeContainer

abstract GetAttributeContainerByIndex(container_type, index)[source]

Retrieves a specific attribute container.

Parameters:
  • container_type (str) – attribute container type.

  • index (int) – attribute container index.

Returns:

attribute container or None if not available.

Return type:

AttributeContainer

abstract GetAttributeContainers(container_type, filter_expression=None)[source]

Retrieves a specific type of attribute containers.

Parameters:
  • container_type (str) – attribute container type.

  • filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.

Returns:

attribute container generator.

Return type:

generator(AttributeContainer)

abstract GetNumberOfAttributeContainers(container_type)[source]

Retrieves the number of a specific type of attribute containers.

Parameters:

container_type (str) – attribute container type.

Returns:

the number of containers of a specified type.

Return type:

int

abstract HasAttributeContainers(container_type)[source]

Determines if a store contains a specific type of attribute container.

Parameters:

container_type (str) – attribute container type.

Returns:

True if the store contains the specified type of attribute

containers.

Return type:

bool

abstract Open(**kwargs)[source]

Opens the store.

SetStorageProfiler(storage_profiler)[source]

Sets the storage profiler.

Parameters:

storage_profiler (StorageProfiler) – storage profiler.

UpdateAttributeContainer(container)[source]

Updates an existing attribute container.

Parameters:

container (AttributeContainer) – attribute container.

Raises:
  • OSError – if the store cannot be written to.

  • IOError – if the store cannot be written to.

__init__()[source]

Initializes an attribute container store.

class acstore.interface.AttributeContainerStoreWithReadCache[source]

Bases: AttributeContainerStore

Interface of an attribute container store with read cache.

format_version

storage format version.

Type:

int

__init__()[source]

Initializes an attribute container store with read cache.

class acstore.interface.AttributeSerializer[source]

Bases: object

Attribute serializer.

abstract DeserializeValue(value)[source]

Deserializes a value.

Parameters:

value (object) – serialized value.

Returns:

runtime value.

Return type:

object

abstract SerializeValue(value)[source]

Serializes a value.

Parameters:

value (object) – runtime value.

Returns:

serialized value.

Return type:

object

acstore.profilers module

The profiler classes.

class acstore.profilers.CPUTimeMeasurement[source]

Bases: object

The CPU time measurement.

start_sample_time

start sample time or None if not set.

Type:

float

total_cpu_time

total CPU time or None if not set.

Type:

float

SampleStart()[source]

Starts measuring the CPU time.

SampleStop()[source]

Stops measuring the CPU time.

__init__()[source]

Initializes the CPU time measurement.

class acstore.profilers.StorageProfiler(identifier, path)[source]

Bases: object

The storage profiler.

classmethod IsSupported()[source]

Determines if the profiler is supported.

Returns:

True if the profiler is supported.

Return type:

bool

Sample(profile_name, operation, description, data_size, compressed_data_size)[source]

Takes a sample of data read or written for profiling.

Parameters:
  • profile_name (str) – name of the profile to sample.

  • operation (str) – operation, either ‘read’ or ‘write’.

  • description (str) – description of the data read.

  • data_size (int) – size of the data read in bytes.

  • compressed_data_size (int) – size of the compressed data read in bytes.

Start()[source]

Starts the profiler.

StartTiming(profile_name)[source]

Starts timing CPU time.

Parameters:

profile_name (str) – name of the profile to sample.

Stop()[source]

Stops the profiler.

StopTiming(profile_name)[source]

Stops timing CPU time.

Parameters:

profile_name (str) – name of the profile to sample.

__init__(identifier, path)[source]

Initializes a storage profiler.

Sample files are gzip compressed UTF-8 encoded CSV files.

Parameters:
  • identifier (str) – identifier of the profiling session used to create the sample filename.

  • path (str) – path of the sample file.

acstore.sqlite_store module

SQLite-based attribute container store.

acstore.sqlite_store.PythonAST2SQL(ast_node)[source]

Converts a Python AST to SQL.

Parameters:

ast_node (ast.Node) – node of the Python AST.

Returns:

SQL statement that represents the node.

Return type:

str

Raises:

TypeError – if the type of node is not supported.

class acstore.sqlite_store.SQLiteAttributeContainerStore[source]

Bases: AttributeContainerStoreWithReadCache

SQLite-based attribute container store.

format_version

storage format version.

Type:

int

serialization_format

serialization format.

Type:

str

classmethod CheckSupportedFormat(path)[source]

Checks if the attribute container store format is supported.

Parameters:

path (str) – path to the attribute container store.

Returns:

True if the format is supported.

Return type:

bool

Close()[source]

Closes the file.

Raises:
  • IOError – if the attribute container store is already closed.

  • OSError – if the attribute container store is already closed.

GetAttributeContainerByIdentifier(container_type, identifier)[source]

Retrieves a specific type of container with a specific identifier.

Parameters:
Returns:

attribute container or None if not available.

Return type:

AttributeContainer

Raises:
  • IOError – when the store is closed or if an unsupported attribute container is provided.

  • OSError – when the store is closed or if an unsupported attribute container is provided.

GetAttributeContainerByIndex(container_type, index)[source]

Retrieves a specific attribute container.

Parameters:
  • container_type (str) – attribute container type.

  • index (int) – attribute container index.

Returns:

attribute container or None if not available.

Return type:

AttributeContainer

Raises:
  • IOError – when there is an error querying the attribute container store or if an unsupported attribute container is provided.

  • OSError – when there is an error querying the attribute container store or if an unsupported attribute container is provided.

GetAttributeContainers(container_type, filter_expression=None)[source]

Retrieves a specific type of stored attribute containers.

Parameters:
  • container_type (str) – attribute container type.

  • filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.

Returns:

attribute container generator.

Return type:

generator(AttributeContainer)

Raises:
  • IOError – when there is an error querying the attribute container store or if an unsupported attribute container is provided.

  • OSError – when there is an error querying the attribute container store or if an unsupported attribute container is provided.

GetNumberOfAttributeContainers(container_type)[source]

Retrieves the number of a specific type of attribute containers.

Parameters:

container_type (str) – attribute container type.

Returns:

the number of containers of a specified type.

Return type:

int

HasAttributeContainers(container_type)[source]

Determines if store contains a specific type of attribute containers.

Parameters:

container_type (str) – attribute container type.

Returns:

True if the store contains the specified type of attribute

containers.

Return type:

bool

Open(path=None, read_only=True, **unused_kwargs)[source]

Opens the store.

Parameters:
  • path (Optional[str]) – path to the attribute container store.

  • read_only (Optional[bool]) – True if the file should be opened in read-only mode.

Raises:
  • IOError – if the attribute container store is already opened or if the database cannot be connected.

  • OSError – if the attribute container store is already opened or if the database cannot be connected.

  • ValueError – if path is missing.

__init__()[source]

Initializes a SQLite attribute container store.

class acstore.sqlite_store.SQLiteSchemaHelper[source]

Bases: object

SQLite schema helper.

DeserializeValue(data_type, value)[source]

Deserializes a value.

Parameters:
  • data_type (str) – schema data type.

  • value (object) – serialized value.

Returns:

runtime value.

Return type:

object

Raises:
  • IOError – if the schema data type is not supported.

  • OSError – if the schema data type is not supported.

GetStorageDataType(data_type)[source]

Retrieves the storage data type.

Parameters:

data_type (str) – schema data type.

Returns:

corresponding SQLite data type.

Return type:

str

SerializeValue(data_type, value)[source]

Serializes a value.

Parameters:
  • data_type (str) – schema data type.

  • value (object) – runtime value.

Returns:

serialized value.

Return type:

object

Raises:
  • IOError – if the schema data type is not supported.

  • OSError – if the schema data type is not supported.

Module contents

Attribute Container Storage (ACStore).

ACStore, or Attribute Container Storage, provides a stand-alone implementation to read and write plaso storage files.