|
|
|
|
|
|
|
|
|
|
|
check_magic(self)
@return A boolean that indicates if the first eight bytes of
the FileHeader match the expected magic value. |
source code
|
|
|
|
calculate_checksum(self)
@return A integer in the range of an unsigned int that
is the calculated CRC32 checksum off the first 0x78 bytes. |
source code
|
|
|
|
verify(self)
@return A boolean that indicates that the FileHeader
successfully passes a set of heuristic checks that
all EVTX FileHeaders should pass. |
source code
|
|
|
|
is_dirty(self)
@return A boolean that indicates that the log has been
opened and was changed, though not all changes might be
reflected in the file header. |
source code
|
|
|
|
is_full(self)
@return A boolean that indicates that the log
has reached its maximum configured size and the retention
policy in effect does not allow to reclaim a suitable amount
of space from the oldest records and an event message could
not be written to the log file. |
source code
|
|
|
|
first_chunk(self)
@return A ChunkHeader instance that is the first chunk
in the log file, which is always found directly after
the FileHeader. |
source code
|
|
|
|
current_chunk(self)
@return A ChunkHeader instance that is the current chunk
indicated by the FileHeader. |
source code
|
|
|
|
chunks(self)
@return A generator that yields the chunks of the log file
starting with the first chunk, which is always found directly
after the FileHeader, and continuing to the end of the file. |
source code
|
|
|
|
|
|
Inherited from BinaryParser.Block:
__unicode__,
absolute_offset,
current_field_offset,
declare_field,
offset,
pack_word,
unpack_binary,
unpack_byte,
unpack_dosdate,
unpack_double,
unpack_dword,
unpack_dword_be,
unpack_filetime,
unpack_float,
unpack_guid,
unpack_int16,
unpack_int32,
unpack_int64,
unpack_int8,
unpack_qword,
unpack_string,
unpack_systemtime,
unpack_word,
unpack_word_be,
unpack_wstring
Inherited from object:
__delattr__,
__format__,
__getattribute__,
__hash__,
__new__,
__reduce__,
__reduce_ex__,
__setattr__,
__sizeof__,
__subclasshook__
|