1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
|
<?xml version="1.0" encoding="ascii"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Class Hierarchy</title>
<link rel="stylesheet" href="epydoc.css" type="text/css" />
<script type="text/javascript" src="epydoc.js"></script>
</head>
<body bgcolor="white" text="black" link="blue" vlink="#204080"
alink="#204080">
<!-- ==================== NAVIGATION BAR ==================== -->
<table class="navbar" border="0" width="100%" cellpadding="0"
bgcolor="#a0c0ff" cellspacing="0">
<tr valign="middle">
<!-- Home link -->
<th> <a
href="Evtx-module.html">Home</a> </th>
<!-- Tree link -->
<th bgcolor="#70b0f0" class="navbar-select"
> Trees </th>
<!-- Index link -->
<th> <a
href="identifier-index.html">Indices</a> </th>
<!-- Help link -->
<th> <a
href="help.html">Help</a> </th>
<!-- Project homepage -->
<th class="navbar" align="right" width="100%">
<table border="0" cellpadding="0" cellspacing="0">
<tr><th class="navbar" align="center"
><a class="navbar" target="_top" href="www.williballenthin.com/evtx/doc/">python-evtx</a></th>
</tr></table></th>
</tr>
</table>
<table width="100%" cellpadding="0" cellspacing="0">
<tr valign="top">
<td width="100%"> </td>
<td>
<table cellpadding="0" cellspacing="0">
<!-- hide/show private -->
<tr><td align="right"><span class="options">[<a href="javascript:void(0);" class="privatelink"
onclick="toggle_private();">hide private</a>]</span></td></tr>
<tr><td align="right"><span class="options"
>[<a href="frames.html" target="_top">frames</a
>] | <a href="class-tree.html"
target="_top">no frames</a>]</span></td></tr>
</table>
</td>
</tr>
</table>
<center><b>
[ <a href="module-tree.html">Module Hierarchy</a>
| <a href="class-tree.html">Class Hierarchy</a> ]
</b></center><br />
<h1 class="epydoc">Class Hierarchy</h1>
<ul class="nomargin-top">
<li> <strong class="uidlink"><a href="Evtx.Nodes.SYSTEM_TOKENS-class.html">Evtx.Nodes.SYSTEM_TOKENS</a></strong>
</li>
<li> <strong class="uidlink">object</strong>:
<em class="summary">The most base type</em>
<ul>
<li> <strong class="uidlink">exceptions.BaseException</strong>:
<em class="summary">Common base class for all exceptions</em>
<ul>
<li> <strong class="uidlink">exceptions.Exception</strong>:
<em class="summary">Common base class for all non-exit exceptions.</em>
<ul>
<li> <strong class="uidlink"><a href="Evtx.BinaryParser.BinaryParserException-class.html">Evtx.BinaryParser.BinaryParserException</a></strong>:
<em class="summary">Base Exception class for binary parsing.</em>
<ul>
<li> <strong class="uidlink"><a href="Evtx.BinaryParser.ParseException-class.html">Evtx.BinaryParser.ParseException</a></strong>:
<em class="summary">An exception to be thrown during binary parsing, such as when an
invalid header is encountered.</em>
<ul>
<li> <strong class="uidlink"><a href="Evtx.Evtx.InvalidRecordException-class.html">Evtx.Evtx.InvalidRecordException</a></strong>
</li>
<li> <strong class="uidlink"><a href="Evtx.BinaryParser.OverrunBufferException-class.html">Evtx.BinaryParser.OverrunBufferException</a></strong>
</li>
</ul>
</li>
</ul>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SuppressConditionalSubstitution-class.html">Evtx.Nodes.SuppressConditionalSubstitution</a></strong>:
<em class="summary">This exception is to be thrown to indicate that a conditional
substitution evaluated to NULL, and the parent element should
be suppressed.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Views.UnexpectedElementException-class.html">Evtx.Views.UnexpectedElementException</a></strong>
</li>
</ul>
</li>
</ul>
</li>
<li> <strong class="uidlink"><a href="Evtx.BinaryParser.Block-class.html">Evtx.BinaryParser.Block</a></strong>:
<em class="summary">Base class for structure blocks in binary parsing.</em>
<ul>
<li> <strong class="uidlink"><a href="Evtx.Nodes.BXmlNode-class.html">Evtx.Nodes.BXmlNode</a></strong>
<ul>
<li> <strong class="uidlink"><a href="Evtx.Nodes.AttributeNode-class.html">Evtx.Nodes.AttributeNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x06.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.CDataSectionNode-class.html">Evtx.Nodes.CDataSectionNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x07.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.CloseElementNode-class.html">Evtx.Nodes.CloseElementNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x04.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.CloseEmptyElementNode-class.html">Evtx.Nodes.CloseEmptyElementNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x03.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.CloseStartElementNode-class.html">Evtx.Nodes.CloseStartElementNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x02.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.ConditionalSubstitutionNode-class.html">Evtx.Nodes.ConditionalSubstitutionNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x0E.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.EndOfStreamNode-class.html">Evtx.Nodes.EndOfStreamNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x00.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.EntityReferenceNode-class.html">Evtx.Nodes.EntityReferenceNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x09.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.NameStringNode-class.html">Evtx.Nodes.NameStringNode</a></strong>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.NormalSubstitutionNode-class.html">Evtx.Nodes.NormalSubstitutionNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x0D.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.OpenStartElementNode-class.html">Evtx.Nodes.OpenStartElementNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x01.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.ProcessingInstructionDataNode-class.html">Evtx.Nodes.ProcessingInstructionDataNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x0B.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.ProcessingInstructionTargetNode-class.html">Evtx.Nodes.ProcessingInstructionTargetNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x0A.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.RootNode-class.html">Evtx.Nodes.RootNode</a></strong>:
<em class="summary">The binary XML node for the Root node.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.StreamStartNode-class.html">Evtx.Nodes.StreamStartNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x0F.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.TemplateInstanceNode-class.html">Evtx.Nodes.TemplateInstanceNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x0C.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.TemplateNode-class.html">Evtx.Nodes.TemplateNode</a></strong>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.ValueNode-class.html">Evtx.Nodes.ValueNode</a></strong>:
<em class="summary">The binary XML node for the system token 0x05.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.VariantTypeNode-class.html">Evtx.Nodes.VariantTypeNode</a></strong>
<ul>
<li> <strong class="uidlink"><a href="Evtx.Nodes.BXmlTypeNode-class.html">Evtx.Nodes.BXmlTypeNode</a></strong>:
<em class="summary">Variant type 0x21.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.BinaryTypeNode-class.html">Evtx.Nodes.BinaryTypeNode</a></strong>:
<em class="summary">Variant type 0x0E.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.BooleanTypeNode-class.html">Evtx.Nodes.BooleanTypeNode</a></strong>:
<em class="summary">Variant type 0x0D.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.DoubleTypeNode-class.html">Evtx.Nodes.DoubleTypeNode</a></strong>:
<em class="summary">Variant type 0x0C.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.FiletimeTypeNode-class.html">Evtx.Nodes.FiletimeTypeNode</a></strong>:
<em class="summary">Variant type 0x11.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.FloatTypeNode-class.html">Evtx.Nodes.FloatTypeNode</a></strong>:
<em class="summary">Variant type 0x0B.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.GuidTypeNode-class.html">Evtx.Nodes.GuidTypeNode</a></strong>:
<em class="summary">Variant type 0x0F.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.Hex32TypeNode-class.html">Evtx.Nodes.Hex32TypeNode</a></strong>:
<em class="summary">Variant type 0x14.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.Hex64TypeNode-class.html">Evtx.Nodes.Hex64TypeNode</a></strong>:
<em class="summary">Variant type 0x15.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SIDTypeNode-class.html">Evtx.Nodes.SIDTypeNode</a></strong>:
<em class="summary">Variant type 0x13.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SignedByteTypeNode-class.html">Evtx.Nodes.SignedByteTypeNode</a></strong>:
<em class="summary">Variant type 0x03.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SignedDwordTypeNode-class.html">Evtx.Nodes.SignedDwordTypeNode</a></strong>:
<em class="summary">Variant type 0x07.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SignedQwordTypeNode-class.html">Evtx.Nodes.SignedQwordTypeNode</a></strong>:
<em class="summary">Variant type 0x09.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SignedWordTypeNode-class.html">Evtx.Nodes.SignedWordTypeNode</a></strong>:
<em class="summary">Variant type 0x05.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SizeTypeNode-class.html">Evtx.Nodes.SizeTypeNode</a></strong>:
<em class="summary">Variant type 0x10.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.StringTypeNode-class.html">Evtx.Nodes.StringTypeNode</a></strong>:
<em class="summary">Variant type 0x02.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.SystemtimeTypeNode-class.html">Evtx.Nodes.SystemtimeTypeNode</a></strong>:
<em class="summary">Variant type 0x12.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.UnsignedByteTypeNode-class.html">Evtx.Nodes.UnsignedByteTypeNode</a></strong>:
<em class="summary">Variant type 0x04.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.UnsignedDwordTypeNode-class.html">Evtx.Nodes.UnsignedDwordTypeNode</a></strong>:
<em class="summary">Variant type 0x08.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.UnsignedQwordTypeNode-class.html">Evtx.Nodes.UnsignedQwordTypeNode</a></strong>:
<em class="summary">Variant type 0x0A.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.UnsignedWordTypeNode-class.html">Evtx.Nodes.UnsignedWordTypeNode</a></strong>:
<em class="summary">Variant type 0x06.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.WstringArrayTypeNode-class.html">Evtx.Nodes.WstringArrayTypeNode</a></strong>:
<em class="summary">Variant ttype 0x81.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.WstringTypeNode-class.html">Evtx.Nodes.WstringTypeNode</a></strong>:
<em class="summary">Variant ttype 0x01.</em>
</li>
</ul>
</li>
</ul>
</li>
<li> <strong class="uidlink"><a href="Evtx.Evtx.ChunkHeader-class.html">Evtx.Evtx.ChunkHeader</a></strong>
</li>
<li> <strong class="uidlink"><a href="Evtx.Evtx.FileHeader-class.html">Evtx.Evtx.FileHeader</a></strong>
</li>
<li> <strong class="uidlink"><a href="Evtx.Evtx.Record-class.html">Evtx.Evtx.Record</a></strong>
</li>
</ul>
</li>
<li> <strong class="uidlink"><a href="Evtx.Evtx.Evtx-class.html">Evtx.Evtx.Evtx</a></strong>:
<em class="summary">A convenience class that makes it easy to open an
EVTX file and start iterating the important structures.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Nodes.NullTypeNode-class.html">Evtx.Nodes.NullTypeNode</a></strong>:
<em class="summary">Variant type 0x00.</em>
</li>
<li> <strong class="uidlink"><a href="Evtx.Evtx.Template-class.html">Evtx.Evtx.Template</a></strong>
</li>
<li> <strong class="uidlink"><a href="Evtx.BinaryParser.memoize-class.html">Evtx.BinaryParser.memoize</a></strong>:
<em class="summary">cache the return value of a method</em>
</li>
</ul>
</li>
</ul>
<!-- ==================== NAVIGATION BAR ==================== -->
<table class="navbar" border="0" width="100%" cellpadding="0"
bgcolor="#a0c0ff" cellspacing="0">
<tr valign="middle">
<!-- Home link -->
<th> <a
href="Evtx-module.html">Home</a> </th>
<!-- Tree link -->
<th bgcolor="#70b0f0" class="navbar-select"
> Trees </th>
<!-- Index link -->
<th> <a
href="identifier-index.html">Indices</a> </th>
<!-- Help link -->
<th> <a
href="help.html">Help</a> </th>
<!-- Project homepage -->
<th class="navbar" align="right" width="100%">
<table border="0" cellpadding="0" cellspacing="0">
<tr><th class="navbar" align="center"
><a class="navbar" target="_top" href="www.williballenthin.com/evtx/doc/">python-evtx</a></th>
</tr></table></th>
</tr>
</table>
<table border="0" cellpadding="0" cellspacing="0" width="100%%">
<tr>
<td align="left" class="footer">
Generated by Epydoc 3.0.1 on Fri May 31 00:38:24 2013
</td>
<td align="right" class="footer">
<a target="mainFrame" href="http://epydoc.sourceforge.net"
>http://epydoc.sourceforge.net</a>
</td>
</tr>
</table>
<script type="text/javascript">
<!--
// Private objects are initially displayed (because if
// javascript is turned off then we want them to be
// visible); but by default, we want to hide them. So hide
// them unless we have a cookie that says to show them.
checkCookie();
// -->
</script>
</body>
</html>
|
