PySpark Plaso
Release 2019
A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.
|
Public Member Functions | |
def | filter (cls, path) |
def | extract (cls, path) |
![]() | |
def | get_name (cls) |
def | get_description (cls) |
Extract events from Windows Registry files.
def plaso.tarzan.app.extractors.winreg.WinReg.extract | ( | cls, | |
path | |||
) |
Extract events from a Windows Registry file in the given path. :param path: the path of the file to extract :return: a lit of events
Reimplemented from plaso.tarzan.app.extractors.extractor.Extractor.
def plaso.tarzan.app.extractors.winreg.WinReg.filter | ( | cls, | |
path | |||
) |
Check is the file-path is a file-path of a Windows Registry file. For the filename extensions see https://en.wikipedia.org/wiki/Windows_Registry#File_locations :param path: the file-path to check :return: True iff it is a PE file
Reimplemented from plaso.tarzan.app.extractors.extractor.Extractor.