volatility3.plugins.timeliner module¶
-
class
TimeLinerInterface
[source]¶ Bases:
object
Interface defining methods that timeliner will use to generate a body file.
-
class
TimeLinerType
(value)[source]¶ Bases:
enum.IntEnum
An enumeration.
-
ACCESSED
= 3¶
-
CHANGED
= 4¶
-
CREATED
= 1¶
-
MODIFIED
= 2¶
-
-
class
Timeliner
(*args, **kwargs)[source]¶ Bases:
volatility3.framework.interfaces.plugins.PluginInterface
Runs all relevant plugins that provide time related information and orders the results by time.
Args: context: The context that the plugin will operate within config_path: The path to configuration data within the context configuration data progress_callback: A callable that can provide feedback at progress points
-
build_configuration
()[source]¶ Builds the configuration to save for the plugin such that it can be reconstructed.
-
property
config
¶ The Hierarchical configuration Dictionary for this Configurable object.
- Return type
-
property
context
¶ The context object that this configurable belongs to/configuration is stored in.
- Return type
-
classmethod
get_requirements
()[source]¶ Returns a list of Requirement objects for this plugin.
- Return type
-
classmethod
make_subconfig
(context, base_config_path, **kwargs)¶ Convenience function to allow constructing a new randomly generated sub-configuration path, containing each element from kwargs.
- Parameters
context (
ContextInterface
) – The context in which to store the new configurationbase_config_path (
str
) – The base configuration path on which to build the new configurationkwargs – Keyword arguments that are used to populate the new configuration path
- Returns
The newly generated full configuration path
- Return type
-
property
open
¶ Returns a context manager and thus can be called like open
-
classmethod
unsatisfied
(context, config_path)¶ Returns a list of the names of all unsatisfied requirements.
Since a satisfied set of requirements will return [], it can be used in tests as follows:
unmet = configurable.unsatisfied(context, config_path) if unmet: raise RuntimeError("Unsatisfied requirements: {}".format(unmet)
- Return type
-
version
= (0, 0, 0)¶
-