How to use the pyhindsight.analysis.HindsightEncoder.base_encoder function in pyhindsight

To help you get started, we’ve selected a few pyhindsight examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github obsidianforensics / hindsight / pyhindsight / analysis.py View on Github external
item['timestamp_desc'] = 'Last Visited Time'
            item['data_type'] = 'chrome:history:page_visited'
            item['url_hidden'] = 'true' if item['hidden'] else 'false'
            if item['visit_duration'] == u'None':
                del (item['visit_duration'])

            item['message'] = u'{} ({}) [count: {}]'.format(
                item['url'], item['title'], item['visit_count'])

            del(item['name'], item['row_type'], item['visit_time'],
                item['last_visit_time'], item['hidden'])
            return item

        if isinstance(obj, Chrome.DownloadItem):
            item = HindsightEncoder.base_encoder(obj)

            item['timestamp_desc'] = 'File Downloaded'
            item['data_type'] = 'chrome:history:file_downloaded'

            item['message'] = u'{} ({}). Received {}/{} bytes'.format(
                item['url'],
                item['full_path'] if item.get('full_path') else item.get('target_path'),
                item['received_bytes'], item['total_bytes'])

            del(item['row_type'], item['start_time'])
            return item

        if isinstance(obj, Chrome.CookieItem):
            item = HindsightEncoder.base_encoder(obj)

            item['data_type'] = 'chrome:cookie:entry'