66 lines
2.3 KiB
Python
66 lines
2.3 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
#
|
|
# Copyright 2013 The Plaso Project Authors.
|
|
# Please see the AUTHORS file for details on individual authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""A place to store information about events, such as format strings, etc."""
|
|
|
|
|
|
# TODO: move this class to events/definitions.py or equiv.
|
|
class EventTimestamp(object):
|
|
"""Class to manage event data."""
|
|
# The timestamp_desc values.
|
|
ACCESS_TIME = u'Last Access Time'
|
|
CHANGE_TIME = u'Metadata Modification Time'
|
|
CREATION_TIME = u'Creation Time'
|
|
MODIFICATION_TIME = u'Content Modification Time'
|
|
ENTRY_MODIFICATION_TIME = u'Metadata Modification Time'
|
|
# Added time and Creation time are considered the same.
|
|
ADDED_TIME = u'Creation Time'
|
|
# Written time and Modification time are considered the same.
|
|
WRITTEN_TIME = u'Content Modification Time'
|
|
EXIT_TIME = u'Exit Time'
|
|
LAST_RUNTIME = u'Last Time Executed'
|
|
DELETED_TIME = u'Content Deletion Time'
|
|
|
|
FILE_DOWNLOADED = u'File Downloaded'
|
|
PAGE_VISITED = u'Page Visited'
|
|
# TODO: change page visited into last visited time.
|
|
LAST_VISITED_TIME = u'Last Visited Time'
|
|
|
|
LAST_CHECKED_TIME = u'Last Checked Time'
|
|
|
|
EXPIRATION_TIME = u'Expiration Time'
|
|
START_TIME = u'Start Time'
|
|
END_TIME = u'End Time'
|
|
|
|
LAST_SHUTDOWN = u'Last Shutdown Time'
|
|
|
|
ACCOUNT_CREATED = u'Account Created'
|
|
LAST_LOGIN_TIME = u'Last Login Time'
|
|
LAST_PASSWORD_RESET = u'Last Password Reset'
|
|
|
|
FIRST_CONNECTED = u'First Connection Time'
|
|
LAST_CONNECTED = u'Last Connection Time'
|
|
|
|
LAST_PRINTED = u'Last Printed Time'
|
|
|
|
LAST_RESUME_TIME = u'Last Resume Time'
|
|
|
|
# Note that the unknown time is used for date and time values
|
|
# of which the exact meaning is unknown and being researched.
|
|
# For most cases do not use this timestamp description.
|
|
UNKNOWN = u'Unknown Time'
|