Parse::Evtx::Chunk - parses a chunk of a Microsoft Windows Vista event log file (.evtx)
use Parse::Evtx::Chunk; # create an object for your event log file my $fh = IO::File->new('justachunk.bin', "r"); # create a chunk object my $parser = Parse::Evtx::Chunk->new('FH' => $fh);
# iterate through all event records my $event = $parser->get_first_event(); while (defined $event) { print $event->get_xml(); $event = $file->get_next_event(); }; # all done, close the file handle $fh->close(); =head1 DESCRIPTION
Microsoft Windows Vista records events in a proprietary binary file format. An object of this class represents a parser for a chunk of a Vista event log file. A chunk is a block of 64 kiB of data, that consists of header information, internal tables and event data. The main purpose of this modules is to translate event log files from their native binary form into textual XML.
The chunk object provides central services to other classes, e.g. stacks for elements, strings and XML templates.
This is the constructor for the parser class.
This is a handle object for the event log file. The object is required to be a descendant of IO::File.
Offset into the file handle where the chunk is expected to start. This parameter is optional; it defaults to 0.
This method checks the chunk for certain errors and marks them in a return code. Right now, only the CRC32 check of the chunk header is implemented.
This method retrieves the first event record from a file. It returns an
the Parse::Evtx::Event manpage object on success and undef
on failure. Note that
get_first_event changes the file pointer in the associated file handle object.
This method retrieves the next event record from a file. It returns an
the Parse::Evtx::Event manpage object on success and undef
on failure. Note that
get_next_event changes the file pointer in the associated file handle object.
Returns the offset into the file
Returns the lengths of the section of the log file that corresponds with the chunk object.
new returns undef
, if it doesn't recognize the format of the file.
Other errors will be signalled through assertions and die()
.
This module depends on the following non-standard modules, which are also not part of this package:
Log2t::input::evt, Log2t::input::urlsnarf, Log2t::input::firefox2, Parse::Evtx::BXmlNode::Node0x04, Log2t::input::pdf, dev::template_for_input_module_logfile, Log2t::input::proftpd_xferlog, Log2t::input::volatility, Log2t::input::mssql_errlog, Parse::Evtx::Const, Parse::Evtx::VariantType::Type0x04, Log2t::input::analog_cache, Parse::Evtx::VariantType::Type0x08, Parse::Evtx::VariantType::Type0x0e, Parse::Evtx::Chunk, Log2t::input::apache2_access, Log2t::output::beedocs, Log2t::input::mft, Parse::Evtx::VariantType::Type0x03, Log2Timeline, Parse::Evtx::BXmlNode::SubstArray, Parse::Evtx::VariantType::Type0x05, Parse::Evtx::BXmlNode::Node0x01, Log2t::input::symantec, Log2t::input::firefox3, Log2t::input::isatxt, Log2t::output::mactime_l, Parse::Evtx::VariantType::Type0x0d, Log2t::output::tab, Log2t::BinRead, Parse::Evtx::BXmlNode::Node0x05, Log2t::output::tln, Log2t::output::cef, Parse::Evtx::BXmlNode::NameString, Log2t::input::xpfirewall, Log2t::input::opera, Log2t::input::iis, Log2t::input::oxml, Log2t::input::win_link, Log2t::Time, Parse::Evtx::VariantType::Type0x09, Parse::Evtx::VariantType::Type0x12, Log2t::input::altiris, Parse::Evtx::VariantType::Type0x15, Log2t::input::pcap, Log2t::input::exif, Log2t::input::mcafee, Parse::Evtx::VariantType::Type0x95, Parse::Evtx::VariantType::Type0x94, Log2t::PreProc::user_browser, Log2t::input::recycler, Log2t::input::openvpn, Parse::Evtx::VariantType::Type0x0c, Log2t::output::simile, Log2t::input::mactime, Parse::Evtx::VariantType::Type0x13, Parse::Evtx, Log2t::input::evtx, Parse::Evtx::VariantType, Log2t::input::tln, Parse::Evtx::BXmlNode, Log2t::base::input, Parse::Evtx::VariantType::Type0x21, Parse::Evtx::VariantType::Type0x0f, Parse::Evtx::BXmlNode::Node0x0d, Parse::Evtx::BXmlNode::Node0x0c, Log2t::Numbers, Parse::Evtx::VariantType::Type0x06, Log2t::output::csv, Log2t::input::skype_sql, Log2t::input::l2t_csv, Log2t::input::squid, Log2t::input::security, Parse::Evtx::BXmlNode::Root, Log2t::input::apache2_error, Log2t::input::ftk_dirlisting, Parse::Evtx::BXmlNode::Template, Parse::Evtx::BXmlNode::Node0x0f, Log2t::output::cftl, Parse::Evtx::VariantType::Type0x01, Log2t::input::software, Parse::Evtx::VariantType::Type0x0b, dev::template_for_output_module, Log2t::input::iehistory, Parse::Evtx::VariantType::Type0x07, Log2t::input::restore, Log2t::input::sam, Parse::Evtx::VariantType::Type0x0a, Parse::Evtx::BXmlNode::Node0x00, Parse::Evtx::VariantType::Type0x14, Parse::Evtx::VariantType::Type0x02, Log2t::input::jp_ntfs_change, Log2t::input::ntuser, Log2t::input::setupapi, Parse::Evtx::VariantType::Type0x81, Parse::Evtx::VariantType::Type0x00, Log2t::input::syslog, Parse::Evtx::VariantType::Type0x11, Parse::Evtx::BXmlNode::Node0x0e, Log2t::WinReg, Log2t::input::mcafeehs, Parse::Evtx::VariantType::Type0x10, Log2t::input::wmiprov, Log2t::input::mcafeehel, Log2t::input::encase_dirlisting, Parse::Evtx::Event, Log2t::Common, Log2t::output::mactime, Log2t::Network, Log2t::input::prefetch, Log2t::input::safari, Log2t::input::generic_linux, Log2t::output::tlnx, Log2t::input::sol, Parse::Evtx::BXmlNode::Node0x03, Log2t::PreProc::win_sysinfo, Parse::Evtx::BXmlNode::Node0x02, Log2t::input::system, Log2t::output::sqlite, dev::chrome_cache, Log2t::Win, Parse::Evtx::BXmlNode::Node0x06, Log2t::input::chrome, Log2t::input::ff_bookmark, Log2t::input::ff_cache, Log2t::input::mcafeefireup
Source Code: Parse::Evtx::Chunk
Andreas Schuster (schuster@cpan.org)
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.