sqliterc package

Subpackages

sqliterc.scripts package

Submodules

sqliterc.resources module

SQLite database resources.

class sqliterc.resources.ColumnDefinition[source]

Bases: object

Column definition.

name

name of the column.

Type:: str

value_type

value type of the column.

Type:: str

__init__()[source]: Initializes a column definition.

class sqliterc.resources.DatabaseDefinition[source]

Bases: object

Database definition.

artifact_definition

name of the corresponding Digital Forensics Artifact definition.

Type:: str

database_identifier

identifier of the database.

Type:: str

__init__()[source]: Initializes a database definition.

sqliterc.schema_extractor module

SQLite database file schema extractor.

class sqliterc.schema_extractor.SQLiteSchemaExtractor(artifact_definitions, mediator=None)[source]

Bases: object

SQLite database file schema extractor.

ExtractSchemas(path, options=None)[source]

Extracts database schemas from the path.

Parameters:

path (str) – path of a SQLite 3 database file or storage media image containing SQLite 3 database files.
options (Optional[dfvfs.VolumeScannerOptions]) – volume scanner options. If None the default volume scanner options are used, which are defined in the dfVFS VolumeScannerOptions class.

Yields:

tuple[str, dict[str, str]] –

known database type identifier or the name of: the SQLite database file if not known and schema.

FormatSchema(schema, output_format)[source]

Formats a schema into the output format.

Parameters:

schema (dict[str, str]) – schema as an SQL query per table name.
output_format (str) – output format.

Returns:

formatted schema.

Return type:

str

Raises:

RuntimeError – if a query could not be parsed.

GetDisplayPath(path_segments, data_stream_name=None)[source]

Retrieves a path to display.

Parameters:

path_segments (list[str]) – path segments of the full path of the file entry.
data_stream_name (Optional[str]) – name of the data stream.

Returns:

path to display.

Return type:

str

__init__(artifact_definitions, mediator=None)[source]

Initializes a SQLite database file schema extractor.

Parameters:

artifact_definitions (str) – path to a single artifact definitions YAML file or a directory of definitions YAML files.
mediator (Optional[dfvfs.VolumeScannerMediator]) – a volume scanner mediator.

sqliterc.yaml_definitions_file module

YAML-based database definitions file.

class sqliterc.yaml_definitions_file.YAMLDatabaseDefinitionsFile[source]

Bases: object

YAML-based database definitions file.

A YAML-based database definitions file contains one or more database definitions. A database definition consists of:

artifact_definition: SafariCacheSQLiteDatabaseFile database_identifier: safari:cache.db

Where: * artifact_definition, name of the corresponding Digital Forensics Artifact

definition.

database_identifier, identifier of the database.

ReadFromFile(path)[source]

Reads the event formatters from a YAML file.

Parameters:: path (str) – path to a formatters file.
Yields:: DatabaseDefinition – database definition.

Module contents

SQLite Database resources (sqliterc).