volatility3.framework.renderers.conversion module

convert_ipv4(ip_as_integer)[source]
convert_ipv6(packed_ip)[source]
convert_network_four_tuple(family, four_tuple)[source]

Converts the connection four_tuple:

(source ip, source port, dest ip, dest port)

into their string equivalents. IP addresses are expected as a tuple of unsigned shorts. Ports are converted to proper endianness as well.

convert_port(port_as_integer)[source]
round(addr, align, up=False)[source]

Round an address up or down based on an alignment.

Parameters:
  • addr (int) – the address

  • align (int) – the alignment value

  • up (bool) – whether to round up or not

Return type:

int

Returns:

The aligned address

unixtime_to_datetime(unixtime)[source]
Return type:

Union[BaseAbsentValue, datetime]

windows_bytes_to_guid(buf)[source]

Converts 16 raw bytes to a windows GUID.

Raises ValueError if the provided buffer is not exactly 16 bytes.

Return type:

str

wintime_to_datetime(wintime)[source]
Return type:

Union[BaseAbsentValue, datetime]